CVE-2026-73863

NanoMQ, an MQTT broker, contains a heap-buffer-overflow in the broker-side function nmq_subinfo_decode() located in nng/src/sp/protocol/mqtt/mqtt_parser.c. The root cause is an incorrect reuse of the len_of_varint value from the outer Properties Length field when parsing repeated SUBSCRIPTION_IDE...