CVE-2026-21888Disclosure(emqx / nanomq)

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() accepts 5-byte varints without bounds checks; reliably triggers OOB read / crash when built with ASan. This affects 0.24.6 and earlier.

emqx CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/nanomq/nanomq/security/advisories/GHSA-cggc-6m7w-j7x5

Other references

https://github.com/nanomq/nanomq/issues/2192

Weakness type (CWE)

CWE-125

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

nanomq

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked 1d ago at 2 mentions (2026-03-11); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

emqx

Products

nanomq

Deep dive

Activity timeline4 mentions / 2d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets4 URLs

By indicator

Full discourse4 posts

Infoflowcloud@infoflowcloud210d
Disclosure
🚨*CVE* CVE-2026-21888 NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() accepts 5-byte varints wi… https://www.cve.org/CVERecord?id=CVE-2026-21888 ----- Traducción: Vulnerabilidad CVE… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑21888, detailing an out‑of‑bounds integer‑parsing flaw in NanoMQ’s MQTT v5 handling, without offering a PoC, exploit, or patch guidance.
0000032
57 followersView on X
CVE@CVEnew210d
Disclosure
CVE-2026-21888 NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() accepts 5-byte varints wi… https://www.cve.org/CVERecord?id=CVE-2026-21888
Post summary
The notice announces CVE-2026-21888, an out‑of‑bounds error in NanoMQ’s MQTT v5 variable‑byte integer parsing, without revealing any PoC, exploit, patch, or active exploitation details.
00000222
56.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds213d
Disclosure
CVE-2026-21888 NanoMQ MQTT Broker Variable Byte Integer Parsing Out-of-Bounds Vulnerability https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-21888
Post summary
This post announces CVE-2026-21888, a NanoMQ MQTT broker integer parsing out‑of‑bounds vulnerability, but does not provide any PoC, exploit code, active exploitation claim, or patch information.
0000013
4.0K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash213d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-21888 - MQTT v5 Variable Byte Integer parsing out-of-bounds: get_var_integer() Intel Report: https://ift.tt/zcTdtDW
Post summary
The tweet announces a new CVE-2026-21888 vulnerability in MQTT v5 that involves out-of-bounds parsing, providing a link to an Intel Report for further details.
0000023
343 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	emqx	nanomq	-	-	-

Explore more

Back to dashboard emqx CVEs nanomq vulnerabilities

What researchers are saying

CVE-2026-21888

Infoflowcloud@infoflowcloudDisclosure

The tweet announces CVE‑2026‑21888, detailing an out‑of‑bounds integer‑parsing flaw in NanoMQ’s MQTT v5 handling, without offering a PoC, exploit, or patch guidance.

CVE@CVEnewDisclosure

The notice announces CVE-2026-21888, an out‑of‑bounds error in NanoMQ’s MQTT v5 variable‑byte integer parsing, without revealing any PoC, exploit, patch, or active exploitation details.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

This post announces CVE-2026-21888, a NanoMQ MQTT broker integer parsing out‑of‑bounds vulnerability, but does not provide any PoC, exploit code, active exploitation claim, or patch information.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The tweet announces a new CVE-2026-21888 vulnerability in MQTT v5 that involves out-of-bounds parsing, providing a link to an Intel Report for further details.