High · 7.5 CVE-2016-1000242 GHSA-hg78-c92r-hvwr

Denial of Service in mqtt

Published Sep 1, 2020 · Updated Nov 8, 2023 · Assigned by GHSA

Description

Affected versions of `mqtt` will cause the node process to crash when receiving specially crafted MQTT packets, making the application vulnerable to a denial of service condition.

## Recommendation

Update to v1.0.0 or later

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	mqtt	< 1.0.0	1.0.0	GHSA-hg78-c92r-hvwr

References

https://nvd.nist.gov/vuln/detail/CVE-2016-1000242 advisory
https://github.com/mqttjs/MQTT.js package
https://github.com/mqttjs/MQTT.js/blob/388a084d7803934b18b43c1146c817deaa1396b1/lib/parse.js#L230 web
https://snyk.io/vuln/npm:mqtt:20160817 web
https://www.npmjs.com/advisories/140 web