Null Pointer Dereference in NanoMQ MQTT Broker

CVE-2026-45151

What is CVE-2026-45151?

The NanoMQ MQTT Broker, an Edge Messaging Platform, is susceptible to a null pointer dereference in the quic_stream_recv function. When handling a substream in a reopened state, the code fails to properly check for a null substream pointer. This flaw leads to errant behavior during the AIO completion process, resulting in a system integrity threat, as the mutex associated with the connection remains locked despite an error occurring. Prompt updates to newer versions are advisable to mitigate this issue.

References