CVE-2026-21888: NanoMQ MQTT Broker Buffer Overflow Flaw

CVE-2026-21888 Overview

CVE-2026-21888 is a high-severity out-of-bounds read vulnerability affecting NanoMQ MQTT Broker, an all-around Edge Messaging Platform. The vulnerability exists in the MQTT v5 Variable Byte Integer parsing implementation, specifically within the get_var_integer() function. This function accepts 5-byte variable integers without performing proper bounds checks, which can reliably trigger an out-of-bounds read and application crash when the software is built with AddressSanitizer (ASan). The vulnerability affects NanoMQ version 0.24.6 and earlier.

Critical Impact
Remote attackers can exploit this vulnerability to cause denial of service conditions against NanoMQ MQTT broker instances by sending specially crafted MQTT v5 packets containing malformed variable byte integers.

Affected Products

NanoMQ MQTT Broker version 0.24.6 and earlier
Systems running NanoMQ as an edge messaging platform
IoT deployments utilizing NanoMQ for MQTT messaging

Discovery Timeline

2026-03-11 - CVE CVE-2026-21888 published to NVD
2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-21888

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory safety issue that occurs when software reads data past the boundary of an allocated buffer. In the context of NanoMQ, the parsing logic for MQTT v5 Variable Byte Integers fails to properly validate input boundaries before attempting to read memory.

The MQTT v5 protocol specification defines Variable Byte Integers as a compact encoding scheme that can represent values from 0 to 268,435,455 using between 1 and 4 bytes. Each byte uses the most significant bit as a continuation flag, with the remaining 7 bits contributing to the value. The NanoMQ implementation incorrectly accepts a 5-byte sequence, which violates the protocol specification and leads to reading beyond the intended buffer boundaries.

The impact includes potential information disclosure through memory content leakage, as well as reliable denial of service through application crashes. The network-accessible nature of MQTT services means this vulnerability can be exploited remotely without authentication.

Root Cause

The root cause lies in the get_var_integer() function within the NanoMQ codebase, which lacks proper validation of the Variable Byte Integer length. According to the MQTT v5 specification, variable byte integers must be encoded in a maximum of 4 bytes. However, the vulnerable implementation continues parsing beyond this boundary when presented with a malformed packet containing a 5-byte sequence with continuation bits set.

The absence of bounds checking allows an attacker to craft a packet that causes the parser to read memory beyond the allocated input buffer, resulting in either an out-of-bounds read that may leak sensitive memory contents or a crash when attempting to access unmapped memory regions.

Attack Vector

The attack can be executed remotely over the network by any client capable of establishing a connection to the NanoMQ MQTT broker. No authentication or special privileges are required to exploit this vulnerability.

An attacker would craft a malicious MQTT v5 packet containing a Variable Byte Integer field with more than 4 bytes, each with the continuation bit set. When the NanoMQ broker parses this packet, the get_var_integer() function reads beyond the allocated buffer, triggering the out-of-bounds read condition.

The vulnerability mechanism operates as follows: when a malformed MQTT v5 packet arrives at the broker, the parser attempts to decode variable-length integer fields. Without proper boundary validation, the parser continues reading bytes as long as continuation flags are present, eventually accessing memory beyond the packet buffer. For technical implementation details, refer to the GitHub Issue Discussion and the GitHub Security Advisory GHSA-cggc-6m7w-j7x5.

Detection Methods for CVE-2026-21888

Indicators of Compromise

Unexpected NanoMQ broker crashes or service restarts
Malformed MQTT v5 packets with oversized Variable Byte Integer fields (more than 4 bytes)
Connection attempts followed by immediate disconnections with error conditions
Memory access violation logs in system journals when running NanoMQ
Increased frequency of segmentation fault signals from the NanoMQ process

Detection Strategies

Deploy network intrusion detection rules to identify MQTT v5 packets with malformed Variable Byte Integer sequences exceeding 4 bytes
Monitor NanoMQ process health for unexpected crashes, restarts, or abnormal termination signals
Implement MQTT protocol validation at network boundaries to filter non-compliant packets before they reach the broker
Enable AddressSanitizer in development/staging environments to catch exploitation attempts with detailed diagnostics
Analyze MQTT connection patterns for anomalous behavior such as repeated malformed packet submissions

Monitoring Recommendations

Configure centralized logging for NanoMQ broker instances to capture crash events and error conditions
Set up alerting on NanoMQ process termination events using process monitoring tools
Implement MQTT traffic analysis to baseline normal packet sizes and flag anomalies
Monitor system memory access patterns for signs of out-of-bounds read attempts
Establish baseline metrics for MQTT connection success rates to detect exploitation attempts

How to Mitigate CVE-2026-21888

Immediate Actions Required

Update NanoMQ MQTT Broker to the latest patched version that addresses this vulnerability
Implement network segmentation to restrict access to MQTT broker services to trusted clients only
Deploy MQTT-aware firewalls or proxies that can validate protocol compliance before forwarding to the broker
Review and restrict network access to NanoMQ instances using firewall rules
Enable process monitoring and automatic restart capabilities to minimize service disruption

Patch Information

The NanoMQ development team has addressed this vulnerability. Users should upgrade to a version newer than 0.24.6 that includes the fix for the Variable Byte Integer parsing issue. Detailed patch information and security guidance are available in the GitHub Security Advisory GHSA-cggc-6m7w-j7x5.

Workarounds

Restrict network access to NanoMQ broker services using firewall rules to limit exposure to trusted networks only
Deploy an MQTT proxy or gateway that performs protocol validation and filters malformed packets
Implement client authentication requirements to reduce the attack surface from anonymous connections
Consider running NanoMQ in a containerized environment with resource limits to contain potential crashes
Monitor for and automatically restart crashed NanoMQ instances while awaiting patch deployment

bash

# Example: Restrict MQTT access to trusted network ranges using iptables
iptables -A INPUT -p tcp --dport 1883 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1883 -j DROP

# Example: Enable NanoMQ process monitoring with systemd restart
# In /etc/systemd/system/nanomq.service
# [Service]
# Restart=on-failure
# RestartSec=5s