Mercun is legal in Malaysia now — 45 types of it. But you still need a permit, and people are still losing legs.

If you learned Malaysian firework law more than a couple of years ago, throw it out. The rule everyone repeats — "only two types are legal, Pop-Pop and sparklers" — is out of date.

Under the 2025 Explosives Prohibition Notification, the Home Minister has approved 45 types of fireworks for possession and importation, including the Pop-Pop and Happy Boom families. That's a real liberalisation, and it caught a lot of people by surprise.

Now the part everyone skips: legal doesn't mean free-for-all. Possession still requires a permit from your district police chief. And in February 2026, a man in his 30s in Bukit Siput, Segamat, lost his left leg below the knee playing with a "shoot cake 4'D 16 shot" outside his house on Chinese New Year. That's a Happy Boom-category item — the approved kind.

1. What's actually legal now

The Ministry of Home Affairs (KDN) authorised 45 firework types under the 2025 notification. The main consumer categories:

• Pop-Pop — the small impact snaps you throw on the ground. Effectively the safest thing on the list.
• Happy Boom — the KDN-certified consumer range: fountains, small cakes, ground-based effects.
• Sparklers — hand-held, approved for controlled use.

The classification logic is about explosive mass. Approved items sit in the low-hazard Class 1.4G band. Higher-hazard Class 1.3G items stay banned.

But possession requires a permit. IGP Mohd Khalid Ismail put it plainly ahead of CNY 2026: even permitted fireworks need approval from the relevant district police chief, subject to conditions. That's the step most people don't know exists, and it's the difference between "this item is legal" and "I am legally holding this item".

Other conditions that come with the approved list:

• Licensed dealers only. Buy from a physical seller displaying a valid PDRM permit.
• No sales to under-18s.
• Timing restrictions — discharge after midnight is prohibited except for officially sanctioned events.
• Online purchases are a trap. Listings exist on Shopee, Lazada and TikTok, but couriers restrict flammable goods and many sellers hold no permit. If customs or a courier X-ray catches the parcel, you've lost your money and possibly acquired a criminal problem.

2. What will still get you seven years

Sections 6, 7 and 8 of the Explosives Act 1957 cover causing explosions that endanger life or property, and manufacturing or possessing illegal explosives. Penalty: up to 7 years' imprisonment, a fine of RM10,000, or both, plus seizure.

The banned items Malaysians actually use:

Mercun bola (ball firecracker) — prohibited, and a regular source of festive-season hospital cases. In March 2026, police in Pendang, Kedah investigated viral claims of several people injured by one on the eve of Aidilfitri.

Meriam buluh (bamboo cannon) — the kampung classic. Still illegal, still causing burns every Raya.

Mercun kelapa — this one deserves a specific warning. It's not a commercial product at all. It's typically homemade or illegally imported, hand-packed with large quantities of explosive powder — potassium nitrate, sulphur and charcoal, essentially gunpowder. Because it's hand-packed, the explosive content varies wildly from one to the next. You cannot know what you're holding.

On Deepavali eve 2025 in Paya Besar, Kulim, a mercun kelapa explosion injured 22 people. Police investigated under section 8. Reports indicated one of those involved had been drinking and set the device upside down before lighting it.

3. The smuggling numbers explain the enforcement

The reason police are aggressive about this isn't festive killjoy instinct — it's the scale of the illegal supply chain.

In a single quarter, PDRM seized fireworks worth over RM106 million across 60 cases with 68 arrests. The largest single tranche, RM48.5 million, came from duty-free zones under the Customs (Prohibition of Imports) Order 2023, followed by the General Operations Force (RM31.7 million), Marine Police (RM24.7 million) and the Federal Reserve Unit (RM1.1 million).

Note what was being smuggled: Happy Boom Cake, Happy Boom Cracker 8-inch, Happy Boom Shoot Cake and similar. These are approved-category product names. The problem isn't only banned item types — it's that enormous volumes enter without permits, import approval or safety verification.

Which raises the uncomfortable point: a "Happy Boom" box in a roadside stall may be smuggled stock of unverified provenance, sold by someone with no permit. The brand name on the packaging tells you nothing about whether that particular item was legally imported or safety-checked.

4. Why "legal" fireworks still take fingers and legs

This is the part the legalisation headlines buried.

The Segamat case in February 2026 involved a shoot cake — an approved consumer category. The victim, in his 30s, suffered a below-knee amputation of his left leg. Police investigated under sections 6 and 8 of the Explosives Act.

Read that sequence again. The item was in the legal family. He was outside his own house. He still lost a leg, and he was still investigated criminally.

Two lessons follow.

Legal category doesn't mean safe. Class 1.4G means lower hazard, not no hazard. A malfunctioning or tipped-over cake fires horizontally at whatever is nearest.

Being injured doesn't stop you being investigated. Sections 6 and 8 cover causing an explosion endangering life and possessing explosive materials. If you were holding it without a permit, or it turns out the item wasn't what you thought, the hospital bed and the police report happen simultaneously.

For parents: this is the argument that actually works with teenagers, better than "it's illegal". The Malaysian festive injury pattern is overwhelmingly hands, eyes and legs, in boys, at close range, with a device that misfired by a second or two.

5. Where you can set them off

Even with the right item and a permit, location matters.

Discharging fireworks in a way that endangers people or property, or that causes public nuisance, brings in the Minor Offences Act 1955 alongside the Explosives Act. Police statements on festive enforcement routinely cite both.

Practical guidance from PDRM has been consistent: open areas, away from buildings, vehicles and crowds, observing safety distances, and not after midnight outside sanctioned events.

Setting off fireworks in a residential lorong, from a balcony, or into the air near houses is where "celebration" turns into a police report from your neighbour — and where the Minor Offences Act does its work.

For an organised public display, that's a different regime entirely: permits coordinated with police, BOMBA notification, licensed pyrotechnicians, a safety plan, insurance and local council approval.

What to actually do

• Check the item is on the approved list before buying. Brand names on packaging aren't proof of legal import.
• Buy from a physical licensed dealer displaying a valid PDRM permit. Not Shopee, not TikTok, not a WhatsApp seller.
• Get the permit. Possession of even approved fireworks requires district police chief approval.
• Never touch mercun bola, meriam buluh or mercun kelapa. These are the ones that cause the mass-casualty incidents.
• Never relight a dud. Wait, soak it, dispose of it. Relighting is the single most common way people lose fingers.
• Open areas only, away from buildings and crowds, and not after midnight.
• Don't let under-18s buy or handle them. Sales to minors are prohibited, and parents are the ones who end up at the police station.
• Injured? Hospital first, 999. Expect a police investigation regardless.