CVE-2025-68699

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, NanoMQ has a protocol parsing / forwarding inconsistency when handling shared subscriptions ($share/). A malformed SUBSCRIBE topic such as $share/ab (missing the second /) is not strictly validated during the subscription stage, so the invalid Topic Filter is stored into the subscription table. Later, when any PUBLISH matches this subscription, the broker send path (nmq_pipe_send_start_v4/v5) performs a second $share/ parsing using strchr() and increments the returned pointer without NULL checks. If the second strchr() returns NULL, sub_topic++ turns the pointer into an invalid address (e.g. 0x1). This invalid pointer is then passed into topic_filtern(), which triggers strlen() and crashes with SIGSEGV. The crash is stable and remotely triggerable. This issue has been patched in version 0.24.7.

• CWE-476

• https://github.com/nanomq/nanomq/commit/89d68d678e7f841ae7baa45cba8d9bc7ddc9ef4bPatch
• https://github.com/nanomq/nanomq/security/advisories/GHSA-qv5f-c6v2-2f8hExploit, Vendor Advisory

Published

Feb 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68693Rejected reason: Not used
• CVE-2025-68694Rejected reason: Not used
• CVE-2025-68695Rejected reason: Not used
• CVE-2025-68696httparty is an API tool. In versions 0.23.2 and prior, httpa…8.2
• CVE-2025-68697n8n is an open source workflow automation platform. Prior to…5.4
• CVE-2025-68698Jervis is a library for Job DSL plugin scripts and shared Je…7.5
• CVE-2025-6870A vulnerability was found in SourceCodester Simple Company W…4.7
• CVE-2025-68700RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…8.8
• CVE-2025-68701Jervis is a library for Job DSL plugin scripts and shared Je…7.5
• CVE-2025-68702Jervis is a library for Job DSL plugin scripts and shared Je…7.5
• CVE-2025-68703Jervis is a library for Job DSL plugin scripts and shared Je…7.5
• CVE-2025-68704Jervis is a library for Job DSL plugin scripts and shared Je…7.5