meshtastic vulnerabilities

CVEs per yearBy the year they were published

1. 20244
2. 20259
3. 20263

Newest CVEs

• CVE-2026-42566

  Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure

  meshtastic · firmware

  High7.5
• CVE-2026-44359

  Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow

  meshtastic · firmware

  Critical10.0
• CVE-2025-55292

  In Meshtastic, an attacker can spoof licensed amateur flag for a node

  meshtastic · firmware

  High8.2
• CVE-2025-53627

  Meshtastic firmware allows forged DMs with no PKC to show up as encrypted

  meshtastic · firmware

  Medium5.3
• CVE-2025-55293

  Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB

  meshtastic · firmware

  Critical9.4
• CVE-2024-47065

  Traceroute_APP responses are not rate-limited.

  meshtastic · firmware

  Low2.7
• CVE-2025-53637

  Meshtastic allows Command Injection in GitHub Action

  meshtastic · firmware

  Medium4.1
• CVE-2025-24798

  Meshtastic crashes via an unimplemented routing module reply

  meshtastic · firmware

  Medium4.3
• CVE-2025-52883

  Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted

  meshtastic · Meshtastic-Android

  Medium5.3
• CVE-2025-52464

  Meshtastic Repeated Public and Private Keypairs

  meshtastic · firmware

  Critical9.5