AIKIDO-2026-366393

TL;DR

NanoMQ's SUBSCRIBE parser in nmq_subinfo_decode() reuses the len_of_varint variable for both the outer Properties Length and the inner SUBSCRIPTION_IDENTIFIER varints without resetting it, so get_var_integer() starts reading at the wrong offset. Combined with missing bounds checking, a crafted Properties field full of repeated subscription-identifier bytes drives the parser to read past the end of the message buffer. An unauthenticated MQTT v5 client can crash the broker, leading to out-of-bounds read. The fix resets the length variable and adds bounds validation during property decoding.