Meshtastic vulnerabilities
We track 10 vulnerabilities in Meshtastic products across 2 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on July 20, 2026.
Latest Meshtastic vulnerabilities
- 10.0 Critical severity
firmware: Improper Control of Generation of Code
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with acc
- 7.5 High severity
Meshtastic is an open source mesh networking solution.
Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long_name that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malf
- 8.2 High severity
firmware: Use of Less Trusted Source
Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by their NodeID, generated from the MAC address, rather than their public key. This aspect downgrades the security, specifically by abusing the
- 9.8 Critical severity
firmware: Improper Authentication
Meshtastic is an open source mesh networking solution. Prior to v2.6.3, an attacker can send NodeInfo with a empty publicKey first, then overwrite it with a new key. First sending a empty key bypasses 'if (p.public_key.size > 0) {', clearing the existing publi
- 8.0 High severity
firmware: Improper Neutralization of Special Elements used in an OS Command
Meshtastic is an open source mesh networking solution. The main_matrix.yml GitHub Action is triggered by the pull_request_target event, which has extensive permissions, and can be initiated by an attacker who forked the repository and created a pull request. I
- 8.3 High severity
firmware: Insufficient Entropy
Meshtastic is an open source mesh networking solution. In versions from 2.5.0 to before 2.6.11, the flashing procedure of several hardware vendors was resulting in duplicated public/private keys. Additionally, the Meshtastic was failing to properly initialize
- 9.8 Critical severity
firmware: Improper Restriction of Operations within the Bounds of a Memory Buffer
Meshtastic is an open source mesh networking solution. A fault in the handling of mesh packets containing invalid protobuf data can result in an attacker-controlled buffer overflow, allowing an attacker to hijack execution flow, potentially resulting in remote
- 7.5 High severity
firmware: Improper Neutralization of Special Elements
Meshtastic firmware is a device firmware for the Meshtastic project. The Meshtastic firmware does not check for packets claiming to be from the special broadcast address (0xFFFFFFFF) which could result in unexpected behavior and potential for DDoS attacks on t
- 9.8 Critical severity
firmware: Incorrect Authorization
Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQTT Server. Nodes can communicate directly via an internet connection or proxied through a connected ph
- 7.5 High severity
firmware: Improper Handling of Exceptional Conditions
Meshtastic device firmware is a firmware for meshtastic devices to run an open source, off-grid, decentralized, mesh network built to run on affordable, low-power devices. Meshtastic device firmware is subject to a denial of serivce vulnerability in MQTT handl