AIKIDO-2026-890099
nanomq.nanomq is vulnerable to Denial of Service (DoS)
37
Low Risk
This Affects:
nanomq.nanomqTL;DR
NanoMQ's MQTT v5 property parser builds a linked list of property nodes with property_append(), which walks the entire list from the head on every insertion. A remote, unauthenticated client can send a single PUBLISH or SUBSCRIBE packet packed with many User Properties to a heavy workload. The broker stops responding for tens of seconds per packet, and repeated packets sustain a denial of service for all connected clients. The fix removes the quadratic traversal so property lists are built in linear time.
Who does this affect?
You are affected if you run a NanoMQ broker on a vulnerable version that accepts MQTT v5 connections from untrusted clients.
Background info
nanomq.nanomq is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 0.24.13.
How to fix this
Upgrade the nanomq.nanomq and/or nanomq.NanoNNG library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant