AIKIDO-2026-182097
mqtt is vulnerable to Denial of Service (DoS)
85
CVE Score
High
Denial of Service (DoS)
TL;DR
MQTT.js's MQTT 5 packet handlers accepted broker-controlled AUTH, Topic Alias, and SUBACK packets without validating protocol state, causing crashes, session state corruption, and an uncaught TypeError. connect() also mutated the caller's properties object, while QoS 2 messages awaiting PUBREL could accumulate without limit. Six GHSA advisories were fixed in v5.16.0: GHSA-8phv-jwjm-93rr, GHSA-c8jq-r765-cq7g, GHSA-fwrw-4mhv-wxvm, GHSA-gfxc-3w7m-8ch4, GHSA-h8jm-hm87-fqw3, and GHSA-rj8f-4655-cgg2.
How do I fix this?
Upgrade the mqtt library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you connect the client to an MQTT broker that is not fully trusted or could be compromised.
Package
Versions
0.0.1 - 5.15.2
Fixed in 5.16.0Background info
mqtt is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 5.15.2.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.