In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in "nni_mqttv5_msg_decode_connect()" allows a malicious MQTT broker to crash any connecting NanoMQ MQTTv5 client (including bridge mode) with a single packet, causing remote denial of service via SIGSEGV. In "nni_mqttv5_msg_decode_connect()" ("mqtt_codec.c:1863"), the code iterates over CONNECT properties using variable "prop" when it should use "will_prop". When a CONNECT packet has no connect-level properties ("prop == NULL") but has will properties ("will_prop != NULL"), dereferencing "prop->next" causes SIGSEGV at address "0x38" (NULL + "offsetof(property, next)"). This affects both "nanomq_cli" and NanoMQ bridge mode (Core component), as both use the same "mqtt_client.c" receive path. This can lead to remote DoS if a malicious MQTT broker can crash the client process with a single 35-byte packet and persistent DoS if auto-reconnect causes infinite crash loop.