MajorCritical vulnerability

CVE-2026-97152 (CVSS 8.6)

NVD · officialPublished Sep 24, 2026Risk 37/100EPSS 0.3%

Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header, through snprintf.

Technical details

CVSS

8.6

AV:NetworkAC:LowPR:LowUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source