Packages / mqtt / Security

HighVulnerabilityGHSA-hg78-c92r-hvwrCVE-2016-1000242Published 1 Sep 2020

Denial of Service in mqtt

Affected releases · mqtt

  • 0.3.x and older0.1.8 – 0.3.13No fix, no longer updated

0.3.x has no fix yet; the newest fixed line:

npm install mqtt@1.0.0
5.x

  1. Not affected

    5.0.0 – 5.16.1

    60 releases, latest

0.x

  1. Affected

    0.1.8 – 0.3.13

    27 releases

210 stable releases of mqtt, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for mqtt. It is read in your browser and sent nowhere.

What happens

Affected versions of mqtt will cause the node process to crash when receiving specially crafted MQTT packets, making the application vulnerable to a denial of service condition.

Recommendation

Update to v1.0.0 or later