CVE-2026-97152: Nanomsg WebSocket Buffer Overflow Flaw

CVE-2026-97152 Overview

CVE-2026-97152 is a heap-based buffer overflow [CWE-122] in the Nanomsg messaging library. The flaw affects the WebSocket transport in Nanomsg versions 0.5-beta through 1.x prior to 1.2.3. The library performs an unchecked copy of the Sec-WebSocket-Version header through snprintf, allowing a remote attacker to overflow a heap buffer during the WebSocket handshake. Successful exploitation can corrupt heap memory in processes using Nanomsg's WebSocket transport, enabling denial of service and potentially arbitrary code execution in the context of the affected process.

Critical Impact
Remote attackers can trigger a heap buffer overflow by sending a crafted Sec-WebSocket-Version header to any service using Nanomsg's WebSocket transport, with no user interaction required.

Affected Products

Nanomsg 0.5-beta through 1.2.2
Applications and services embedding the Nanomsg WebSocket transport
Fixed in Nanomsg 1.2.3

Discovery Timeline

2026-09-24 - CVE-2026-97152 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-97152

Vulnerability Analysis

Nanomsg is a socket library that provides scalable messaging patterns over multiple transports, including WebSocket. During the WebSocket handshake, the server-side implementation parses HTTP upgrade headers from the client. The vulnerable code path copies the attacker-controlled Sec-WebSocket-Version header value into a fixed-size heap buffer using snprintf without validating or bounding the input length against the destination allocation.

Because the handshake occurs before authentication in most deployments, any network peer that can reach the WebSocket listener can supply an oversized header. The overflow writes attacker-controlled bytes past the end of the heap buffer, corrupting adjacent allocator metadata and neighboring objects.

Root Cause

The root cause is an unchecked length during header copy. The affected code uses snprintf to format the Sec-WebSocket-Version header value into a buffer whose size is not reconciled with the attacker-supplied input length. This classifies the defect as a heap-based buffer overflow under [CWE-122]. The fix landed in Nanomsg Pull Request #1130 and shipped in the Nanomsg 1.2.3 release.

Attack Vector

An attacker initiates a WebSocket upgrade request to a listener bound to the Nanomsg WebSocket transport. The attacker supplies a Sec-WebSocket-Version header whose value exceeds the destination buffer size. When the server processes the handshake, the oversized value overflows into adjacent heap memory. Impact ranges from process crash to memory corruption that may be shaped into remote code execution. The attack requires network reachability only and does not require prior authentication at the WebSocket layer. Refer to the Nanomsg project and the fix pull request for additional technical context.

Detection Methods for CVE-2026-97152

Indicators of Compromise

WebSocket upgrade requests containing abnormally long Sec-WebSocket-Version header values, typically well beyond the expected numeric version string.
Crashes, segmentation faults, or heap corruption aborts in processes that link against Nanomsg and expose WebSocket listeners.
Unexpected restarts or memory anomalies on services using the ws:// or wss:// Nanomsg transport.

Detection Strategies

Inspect inbound HTTP upgrade traffic for Sec-WebSocket-Version header values that exceed the RFC 6455 expected length of a few bytes.
Deploy intrusion detection signatures that flag WebSocket handshakes with oversized or non-numeric Sec-WebSocket-Version values.
Correlate process crashes on Nanomsg-based services with inbound WebSocket connection events in the same time window.

Monitoring Recommendations

Enumerate internal services linking Nanomsg and inventory the versions in use to identify instances below 1.2.3.
Enable core dump collection and crash telemetry for Nanomsg-based processes to detect exploitation attempts.
Forward WebSocket proxy and application logs to a centralized analytics backend to identify malformed handshake patterns across the fleet.

How to Mitigate CVE-2026-97152

Immediate Actions Required

Upgrade Nanomsg to version 1.2.3 or later in all applications and container images that embed the library.
Restrict network exposure of Nanomsg WebSocket listeners to trusted segments until the upgrade is complete.
Rebuild and redeploy downstream software that statically links Nanomsg to ensure the patched code is loaded at runtime.

Patch Information

The maintainers resolved the overflow in Nanomsg 1.2.3. The upstream fix is tracked in Pull Request #1130, which corrects the handling of the Sec-WebSocket-Version header. Operators should pull the tagged release, verify the version in built artifacts, and confirm that no vendored copies of older Nanomsg sources remain in the build tree.

Workarounds

Disable the WebSocket transport in Nanomsg-based services where it is not required, and use alternative transports such as TCP or IPC.
Terminate WebSocket connections at a hardened reverse proxy that validates and length-limits HTTP headers before forwarding to the Nanomsg listener.
Apply network ACLs and firewall rules to restrict WebSocket listener reachability to authenticated or trusted clients only.

bash

# Validate the installed Nanomsg version and confirm 1.2.3 or later
pkg-config --modversion nanomsg

# Example reverse proxy header length limit (nginx) in front of a Nanomsg listener
# large_client_header_buffers 4 1k;
# proxy_pass http://nanomsg_backend;