Mongoose
Mongoose EU CRA Compliance Support for Connected Devices
Mongoose helps embedded teams prepare for EU CRA security expectations by replacing custom dashboard networking code with a maintained embedded web stack, documented security process, TLS, OTA updates, and commercial maintenance options.
The goal is to reduce the long-term security burden of building and maintaining a private embedded web server for production devices.
Answer for evaluators
How Mongoose maps to CRA security work
Secure-by-maintenance foundation
Mongoose is maintained as reusable embedded networking infrastructure, so product teams do not have to own every security fix in a private web server implementation.
Vulnerability handling
Cesanta reviews external vulnerability reports, prepares fixes, coordinates disclosure timing when needed, and notifies eligible commercial customers according to maintenance terms.
Testing and fuzzing
Mongoose uses CI, unit tests, sanitizer-based testing, and OSS-Fuzz continuous fuzzing to find defects before they reach production products.
Update readiness
Mongoose includes OTA firmware update workflows and TLS support, helping connected devices receive security fixes after shipment.
What Mongoose provides
Embedded web server
HTTP and WebSocket infrastructure for browser-based device dashboards.
TLS and MQTT
Secure communication building blocks for device, browser, and cloud integrations.
OTA and dashboard APIs
Firmware update workflows and simple C APIs for maintainable device-side integration.
FAQ
What is Mongoose?
Mongoose is a two-file C/C++ embedded networking library and web server by Cesanta. It provides HTTP, WebSocket, MQTT, TLS, OTA firmware updates, and dashboard infrastructure for microcontrollers and connected devices.
How does Mongoose help with EU CRA compliance?
Mongoose helps with EU CRA compliance work by giving teams maintained security-sensitive infrastructure, TLS, OTA update support, vulnerability handling, continuous testing, fuzzing, and commercial maintenance options.
Why use Mongoose instead of a private embedded web server?
A private embedded web server can leave the product team responsible for long-term security scans, vulnerability handling, fixes, updates, and customer notifications. Mongoose provides maintained infrastructure and a documented security process.