Heap-Use-After-Free Vulnerability in NanoMQ MQTT Broker

CVE-2025-65953

What is CVE-2025-65953?

The NanoMQ MQTT Broker, an edge messaging platform, is susceptible to a Heap-Use-After-Free vulnerability in its TCP transport component. This issue arises from inadequate resource management resulting in a premature cleanup of message and pipe structures. It specifically affects cases involving malformed MQTTV5 retain message traffic, which could lead to unexpected behavior or further exploitation. Users are advised to upgrade to version 0.22.5 or later where this vulnerability has been addressed.

References