CVE-2026-42566: Meshtastic Mesh Network DoS Vulnerability

CVE-2026-42566 Overview

CVE-2026-42566 affects Meshtastic, an open source mesh networking solution used across LoRa-based radio devices. Prior to firmware version 2.7.23.b246bcd, a node advertising a User.long_name containing a malformed character encoding can render other radios unusable over Bluetooth Low Energy (BLE) when managed through the iOS app. The malformed name does not require malicious crafting and has been observed occurring naturally through buffer truncation. The poisoned entry propagates through the mesh, causing BLE synchronization on iOS to enter a fail/retry loop. This results in loss of control over affected devices across a wide geographical area until the entry ages out of the on-device database.

Critical Impact
A single node with a malformed User.long_name can cause persistent BLE management failures for iOS-managed Meshtastic radios across the mesh, with no straightforward recovery path for non-technical users.

Affected Products

Meshtastic firmware prior to version 2.7.23.b246bcd
Meshtastic iOS application (encoding validation path)
Downstream nodes participating in mesh synchronization

Discovery Timeline

2026-07-20 - CVE-2026-42566 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-42566

Vulnerability Analysis

The vulnerability stems from improper input validation ([CWE-20]) of UTF-8 encoded strings in the Meshtastic firmware node database. At least one firmware code path places a null terminator in the middle of a multibyte UTF-8 sequence when truncating the User.long_name field. The resulting malformed string persists in the node database and propagates across the mesh through normal node information exchange.

The failure surfaces downstream in the iOS application, which enforces strict UTF-8 encoding validation when parsing the node database. Once a poisoned entry is present, the iOS app cannot complete BLE synchronization and enters a fail/retry loop. The affected radio becomes effectively unusable through the iOS management interface.

Root Cause

The root cause is missing UTF-8 boundary awareness during string truncation. String operations treated the User.long_name buffer as a byte array without preserving multibyte sequence integrity, allowing truncation to bisect a UTF-8 code point. The lack of protobuf-level UTF-8 validation on both encoding and decoding paths permitted these malformed strings to propagate through the mesh.

Attack Vector

The issue is triggered over the network via mesh propagation and requires no privileges or user interaction. While the CVE is classified as an availability impact only, any node in the mesh transmitting a truncated name can render iOS-managed peers unmanageable. The vulnerability has been observed occurring naturally without deliberate exploitation, but a threat actor could deliberately introduce a poisoned entry to disrupt fleet management.

text

// Patch: platformio.ini - enable protobuf UTF-8 validation
 	-DUSE_THREAD_NAMES
 	-DTINYGPS_OPTION_NO_CUSTOM_FIELDS
 	-DPB_ENABLE_MALLOC=1
+	-DPB_VALIDATE_UTF8=1
 	-DRADIOLIB_EXCLUDE_CC1101=1
 	-DRADIOLIB_EXCLUDE_NRF24=1
 	-DRADIOLIB_EXCLUDE_RF69=1

Source: GitHub Firmware Commit 2cc13a1

The patch enables the PB_VALIDATE_UTF8 nanopb flag, which rejects malformed UTF-8 during protobuf encode and decode operations.

cpp

// Patch: src/mesh/TypeConversions.cpp - include sanitization utilities
 #include "TypeConversions.h"
 #include "mesh/generated/meshtastic/deviceonly.pb.h"
 #include "mesh/generated/meshtastic/mesh.pb.h"
+#include "meshUtils.h"

 meshtastic_NodeInfo TypeConversions::ConvertToNodeInfo(const meshtastic_NodeInfoLite *lite)
 {

Source: GitHub Firmware Commit 2cc13a1

Detection Methods for CVE-2026-42566

Indicators of Compromise

iOS Meshtastic app repeatedly failing BLE synchronization and entering retry loops against a previously working radio.
Node database entries containing User.long_name values with invalid UTF-8 byte sequences or trailing partial multibyte characters.
Reports from multiple iOS users in the same geographic mesh area losing device manageability simultaneously.

Detection Strategies

Enumerate node databases through the Meshtastic Python CLI and validate each User.long_name field against strict UTF-8 decoding.
Compare firmware versions across managed radios and flag any node running a build prior to 2.7.23.b246bcd.
Monitor mesh telemetry for repeated BLE connection resets originating from iOS clients.

Monitoring Recommendations

Log Python CLI queries against the node database on a scheduled basis to catch poisoned entries before they propagate widely.
Track firmware version distribution across the fleet and prioritize upgrades for nodes acting as high-traffic mesh relays.
Alert on iOS support tickets that describe repeated pairing or sync failures, which may indicate an active poisoned entry.

How to Mitigate CVE-2026-42566

Immediate Actions Required

Upgrade Meshtastic firmware to version 2.7.23.b246bcd or later on all managed nodes.
Use the Meshtastic Python CLI to identify and remove poisoned User.long_name entries from the local node database on affected radios.
Update the Meshtastic iOS application to the latest version, which handles malformed encoding sequences more gracefully.

Patch Information

The fix is delivered in firmware commit 2cc13a1132d94b66a9505e7f07ee2d3e83bd0c95, which enables PB_VALIDATE_UTF8 in platformio.ini and adds input sanitization in TypeConversions.cpp. Regression tests demonstrate recovery for already-poisoned devices. Details are available in the GitHub Security Advisory GHSA-7ph5-2mjv-69h8.

Workarounds

Manage affected radios through the Meshtastic Python CLI instead of the iOS app until the poisoned entry ages out of the node database.
Manually delete offending node entries via CLI commands to restore iOS BLE synchronization.
Temporarily isolate unpatched nodes from the broader mesh to prevent further propagation of malformed User.long_name values.

bash

# Identify and remove a poisoned node entry using the Meshtastic Python CLI
pip install --upgrade meshtastic
meshtastic --info                       # list nodes and inspect long_name fields
meshtastic --remove-node <node_id>      # remove the offending entry
meshtastic --reboot                     # reboot to clear cached state