CVE-2026-47276: NanoMQ Denial of Service Vulnerability

CVE-2026-47276 Overview

CVE-2026-47276 is a NULL pointer dereference vulnerability [CWE-476] in the NanoMQ broker affecting versions 0.24.11 and earlier. The flaw resides in the properties_parse() function within the HTTP publish API. An authenticated attacker can crash the broker by sending a POST request to /api/v4/mqtt/publish with the user_properties field structured as a JSON array instead of the expected JSON object. When the parser iterates over array elements, it invokes strlen() on a NULL item->string pointer, terminating the broker process. The issue is patched in version 0.24.14.

Critical Impact
Authenticated attackers can trigger a broker crash with a single malformed HTTP publish request, disrupting MQTT message delivery for all connected clients.

Affected Products

NanoMQ versions 0.24.11 and earlier
NanoMQ HTTP publish API endpoint /api/v4/mqtt/publish
MQTT broker deployments relying on the vulnerable properties_parse() code path

Discovery Timeline

2026-07-20 - CVE-2026-47276 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47276

Vulnerability Analysis

The vulnerability is a denial-of-service condition caused by unsafe JSON parsing in the NanoMQ broker's HTTP API. NanoMQ exposes an HTTP publish endpoint at /api/v4/mqtt/publish that accepts a JSON payload containing MQTT publish parameters, including an optional user_properties field. The broker expects user_properties to be a JSON object whose keys and values map directly onto MQTT 5.0 user property key-value pairs.

When the parser receives a JSON array in place of the expected object, it still iterates over the array's child elements. Each child element lacks the string field that would normally hold the property key. The properties_parse() function then calls strlen() on this NULL item->string pointer, causing a segmentation fault that terminates the broker process. Because the crash affects the entire broker, all connected MQTT clients lose their sessions and message flow halts until the service restarts.

Root Cause

The root cause is missing input type validation in properties_parse(). The function assumes the JSON node passed to it is an object and does not verify the structural type of user_properties before dereferencing child element string fields. This class of defect is tracked as CWE-476: NULL Pointer Dereference.

Attack Vector

Exploitation requires network access to the HTTP API and valid API credentials, since the endpoint requires authentication. An attacker submits a POST request to /api/v4/mqtt/publish where the JSON body contains user_properties formatted as an array such as ["foo", "bar"] rather than the expected object {"foo": "bar"}. The broker parses the payload, dereferences a NULL string pointer while iterating the array, and crashes. No memory corruption or code execution results from the flaw; impact is limited to availability. See the GitHub Security Advisory GHSA-qq2v-xvxg-3hvf for full technical details.

Detection Methods for CVE-2026-47276

Indicators of Compromise

Unexpected NanoMQ broker process termination or restart events in system logs
HTTP POST requests to /api/v4/mqtt/publish containing user_properties as a JSON array
Sudden mass disconnection events across MQTT clients tied to a single broker instance
Repeated authenticated API calls from a single source immediately preceding broker crashes

Detection Strategies

Inspect HTTP request bodies to /api/v4/mqtt/publish and flag payloads where user_properties is not a JSON object
Correlate broker crash events with preceding HTTP API activity to identify the triggering client
Monitor NanoMQ process supervisors such as systemd for abnormal restart frequency

Monitoring Recommendations

Enable verbose HTTP API access logging on the NanoMQ broker and forward logs to a centralized SIEM
Alert on core dumps or segmentation faults tied to the NanoMQ binary
Track authentication events for the HTTP API and rate-limit accounts issuing malformed requests

How to Mitigate CVE-2026-47276

Immediate Actions Required

Upgrade NanoMQ to version 0.24.14 or later on all broker instances
Restrict network access to the HTTP API endpoint to trusted management networks only
Rotate NanoMQ HTTP API credentials if broker crashes have been observed in production
Enable automatic broker restart via a process supervisor to reduce downtime while patching

Patch Information

The NanoMQ maintainers addressed the vulnerability in version 0.24.14 by adding type validation in properties_parse() before dereferencing child element string fields. All deployments running 0.24.11 or earlier should upgrade. Refer to the GitHub Security Advisory GHSA-qq2v-xvxg-3hvf for the official fix reference.

Workarounds

Place the NanoMQ HTTP API behind a reverse proxy that validates the JSON schema of user_properties and rejects non-object values
Disable the HTTP publish API if it is not required for operational workflows
Limit HTTP API credentials to a minimal set of trusted automation accounts until the patch is applied

bash

# Example nginx reverse proxy rule to block requests where user_properties is a JSON array
location /api/v4/mqtt/publish {
    if ($request_body ~* "\"user_properties\"\s*:\s*\[") {
        return 400;
    }
    proxy_pass http://nanomq_backend;
}