Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy… (CVE-2026-97152)

Nanomsg versions 0.5-beta through 1.x prior to 1.2.3 have a buffer overflow vulnerability in the WebSocket transport implementation. The flaw is due to an unchecked copy of the Sec-WebSocket-Version header via snprintf, which can be exploited remotely without user interaction. The vulnerability is identified as CVE-2026-97152 and has a CVSS 4.0 vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, scope, and security requirements.

The vulnerability allows remote attackers to trigger a buffer overflow in the WebSocket transport of affected nanomsg versions. This can lead to high impact on confidentiality, integrity, and availability of the affected system. There is no indication of known exploits in the wild. The attack requires no user interaction and no privileges, making it relatively easy to exploit remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.2.3, upgrading to version 1.2.3 or later is likely the intended remediation. Until an official fix is confirmed, avoid exposing the WebSocket transport to untrusted networks.