NanoMQ v0.24.13 Release Note

Apr 21, 2026

NanoMQ 0.24.13 is out. This is the last formal version of 0.24. Since NanoMQ has been widely used in production robotics and vehicles, We are focusing on safety & security hardening, introducing openFuzz & ClusterFuzz to routine workflow.

Following is the full release blog written by Gemini. I am honest, will not take AI' work ^_^

Hello community! NanoMQ 0.24.13 is officially released! 🎉

This update (including the underlying NanoNNG library) brings the highly anticipated MQTT bridge anti-loop feature (supporting Mosquitto's try_private mechanism). It also includes significant enhancements and bug fixes regarding security (introducing Fuzzing tests), core protocol stack stability, and memory safety.

Here are the detailed release notes:

🌟 Highlights

  1. New MQTT v3.1.1 Bridge Anti-Loop Option (no_local_v4) When bridging NanoMQ with brokers like Mosquitto, message loop (echo) issues can frequently occur. In this release, we introduced the no_local_v4 (equivalent to Mosquitto's try_private) option in the bridge configuration.

How it works: When this configuration is enabled, NanoMQ will set the highest bit (Bridge Bit) of the protocol version number to 1 in the MQTT v3.1.1 CONNECT packet (sending 0x84 instead of the standard 0x04). This allows the remote broker to recognize it as a bridge connection and cooperate using native No Local mechanisms to prevent message loops.

Use case: Greatly simplifies routing configurations when integrating NanoMQ with third-party legacy MQTT brokers, effectively avoiding broadcast storms.

  1. Comprehensive Security Upgrades & Fuzzing Tests To build a rock-solid edge messaging bus, we have significantly enhanced our security and automated fuzzing capabilities:

OSS-Fuzz & ClusterFuzzLite Integration: Introduced advanced Fuzzing support, specifically adding a Fuzzer for MQTT PUBLISH packets to proactively discover potential memory and parsing vulnerabilities.

Clarified NanoMQ's CVE vulnerability reporting policy and guidelines (Updated SECURITY.md).

🐛 Bug Fixes & Stability Improvements We addressed several critical issues reported by the community in this iteration, covering topic routing, protocol parsing, and underlying network scheduling:

Protocol & Routing:

Topic Alias: Fixed two protocol violations in MQTT topic alias handling.

Will Message: Fixed an issue where encoding Will messages failed for MQTT V5.

Retain Message: Fixed the missing pipe_id in retain messages, and a bug where the retain flag was not properly reset for MQTT V3.1/V3.1.1.

Special Topic Subscriptions: Fixed the routing search logic for system/reserved topics starting with $.

Underlying Network & Session State (NanoNNG):

Fixed a send AIO error on macOS caused by handling no_local messages.

Fixed an abnormal keepalive mechanism in the underlying nmq_mqtt client.

Fixed regression bugs caused by context loss from AI-assisted coding.

Fixed a potential message stall issue caused by underlying packet accumulation.

Fixed nng action execution exceptions on the Windows platform.

Memory & Database:

Fixed an out-of-bounds read vulnerability in mqtt_parser, and optimized/consolidated the get_utf8_str parsing performance.

Fixed a bug in the SQLite QoS database where unused message entities were not properly removed.

⚙️ Build, Dependencies & CI/CD Updates Upgraded numerous GitHub Actions dependencies via Dependabot (including docker/build-push-action, actions/setup-node, codecov, etc.) to improve pipeline security and build speed.

Bumped the internal JWT authentication library l8w8jwt.

Introduced unit tests automatically generated by CodeRabbit AI to further improve code coverage.

Added a regression validation script for Issue #2246 in integration tests.

👏 Thank You to Our Contributors! The progress of open-source projects relies on the dedication of every community member. A special thank you to the developers making their first code contributions to this release:

@saberrg (for adding OSS-Fuzz integration and the PUBLISH fuzzer)

@tricera-josua-palmstedt (for adding the try_private option to control connection bridge bits in NanoNNG)

Full change commit log:

What's Changed in NanoMQ

New Contributors

Full Changelog: https://github.com/nanomq/nanomq/compare/0.24.11...0.24.13

What's Changed in NanoNNG

New Contributors

Full Changelog: https://github.com/nanomq/NanoNNG/compare/0.24.11...0.24.13

EMQX Cloud

Fully managed MQTT messaging service.

14 Days Free Trial →

Learn MQTT Protocol

The rich and easy-to-understand MQTT guide to help you quickly get started with MQTT protocol.

Learn More →