CVE-2025-59947: Critical Buffer Overflow in NanoMQ

CVE-2025-59947 is a critical (CVSS 9.0) buffer overflow in NanoMQ, the messaging broker for IoT edge and software-defined vehicle systems. Versions before 0.24.4 can overflow a buffer when a PUBLISH packet triggers both a shared subscription and a regular subscription. The fix is 0.24.4. Until then, disable shared subscription.

What's affected

• Product: NanoMQ (EMQX), an MQTT broker and message bus for IoT edge and SDV workloads.
• Weakness: CWE-120, a classic buffer overflow.
• Affected: versions before 0.24.4, per the CVE record. The project advisory titles the report against 0.24.2 and lists 0.24.4 as the patched version.
• Fixed: 0.24.4.
• Workaround from the advisory: disable shared subscription.
• CVSS 3.1: 9.0, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. A low-privilege account and some user interaction are part of that vector, and the scope is changed.

The condition is narrow but clear. A single PUBLISH packet that matches both a shared subscription and an ordinary subscription is what reaches the unsafe code path. Brokers that never use shared subscriptions have a smaller exposure, but the advisory still treats 0.24.4 as the fix.

How to check if you're exposed

Start by finding every NanoMQ instance. Brokers often sit in edge gateways, vehicle test benches and container images that nobody tracks in a spreadsheet.

Check the version the broker reports, or the image tag if you run it in a container:

docker ps --format '{{.Image}}' | grep -i nanomq
docker image ls | grep -i nanomq

For package installs, check the version your package manager or release archive recorded. Anything below 0.24.4 is in scope.

Then check whether shared subscriptions are in use. Shared subscriptions are an MQTT 5 feature where clients subscribe to a topic filter that begins with the share prefix. Look through your client configuration and subscription logs for that prefix. If you find none, your exposure to the specific trigger is lower, but you should still plan the upgrade.

What to do now

1. Inventory all NanoMQ brokers, including edge and test environments, and note each version.
2. Upgrade to NanoMQ 0.24.4 or later. Read the release notes for your deployment method before rolling it out.
3. If you cannot upgrade today, disable shared subscription in the broker configuration, as the advisory recommends, and confirm no clients depend on it.
4. Restrict who can connect and publish. The vector needs a low-privilege account, so tighten broker authentication and topic permissions.
5. Restart the broker after changes and watch for crashes. A buffer overflow often shows up first as an unexplained broker restart.
6. Run the free in-browser dependency scan on any repository that vendors or builds NanoMQ so the version is flagged in future.

Why it matters

A buffer overflow means the program writes past the end of a memory buffer. In a network service written in C, that can crash the process, corrupt data, or in worse cases let an attacker influence what runs. The record scores confidentiality, integrity and availability impact as high, which is why the score sits at 9.0.

The cause here is a specific combination: one PUBLISH packet delivered to both a shared and a normal subscriber. Edge cases where two features meet are a common place for memory bugs, because each path was tested alone. The project's own advisory rates the issue High at 8.5 under CVSS 4.0, slightly lower than the 9.0 in the CVE record, so expect different scanners to show different numbers.

The record does not mark this as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Treat it as a patch-soon item, not an emergency, but do not leave brokers on edge devices unpatched for long, because those are the hardest to reach later.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• github.com/nanomq/nanomq/security/advisories/GHSA-98f4-cmg8- (fetched)
• Safeguard Gold entry for CVE-2025-59947
• github.com/nanomq/nanomq/commit/5f5581054bb92f102cf99251e8af (listed in the CVE record, not fetched)
• github.com/nanomq/nanomq/issues/2110 (listed in the CVE record, not fetched)

Last reviewed: 18 October 2026.