Description
MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HackerOne | mqtt-packet node module | <3.4.6 || > 4.0.0 <4.0.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | mqtt-packet | < 3.4.6 | 3.4.6 | GHSA-g3r2-65gc-qpqc |
| npm | mqtt-packet | >= 4.0.0, < 4.0.5 | 4.0.5 | GHSA-g3r2-65gc-qpqc |