mqtt

Security

This release fixes six advisories. All are reachable from a malicious or misbehaving broker — or anyone who can inject packets into a cleartext mqtt:// hop — with no special client configuration beyond speaking MQTT 5. Upgrade to 5.16.0; everything <= 5.15.2 is affected, including the v4 line, and there is no backport.

Reproduction steps and full analysis stay in the advisories. CVE ids have been requested and will be added here once assigned.

Behaviour changes to check before upgrading

• security

  options is no longer mutated by a CONNACK. Code that read negotiated values back off options.properties.maximumPacketSize or options.keepalive must use the new client.serverProperties / client.keepalive getters instead.

• security

  A refused CONNACK now always closes the socket. With reconnectOnConnackError: false (the default) the client previously sat on an open connection and kept delivering message events after telling the application the connection was refused.

• security

  Protocol violations now drop the connection: a SUBACK reason-code count mismatch, an invalid Topic Alias, an unsolicited or out-of-spec AUTH, and a broker exceeding receiveMaximum on inbound QoS 2 (reason code 0x93). Reconnect stays armed in all cases.

• security

  An ack that does not answer the command pending on that message id is dropped and reported via error, instead of running the wrong completion path.

• security

  The unregistered-alias case now emits reason code 0x82 (Protocol Error) instead of 0x94.

• security

  AUTH reason code 0 ends the exchange successfully; previously it produced an error with an empty reason string.

• security

  properties.receiveMaximum outside 1..65535, or not an integer, is ignored and 65535 is enforced and advertised instead.

• security

  The inbound packet-size cap now measures total wire size rather than Remaining Length, so it triggers on packets a few bytes smaller than before.

• security

  New exports: PacketPump (src/lib/shared.ts), PendingCommand from the entry point.

Reported

Bug Fixes

• security

  bounds-check the suback granted array against subscriptions sent (GHSA-rj8f-4655-cgg2) (#2061) (46ee23f), closes #2060

• security

  enforce MQTT 5 Receive Maximum for inbound QoS 2 messages (GHSA-h8jm-hm87-fqw3) (#2065) (ec5bf3e), closes #2064 #2063 #2062 #2061 #2060

• security

  keep broker CONNACK properties out of the user options object (GHSA-gfxc-3w7m-8ch4) (#2062) (3db16f5), closes #2061 #2060 #2060 #2060

• security

  reject a duplicate CONNACK instead of re-running connection setup (GHSA-8phv-jwjm-93rr) (#2064) (7108ea5), closes #2063 #2062 #2061 #2060

• security

  reject an unsolicited AUTH instead of crashing the process (GHSA-fwrw-4mhv-wxvm) (#2063) (b511e7b), closes #2062 #2061 #2060 #2060

• security

  reject unsolicited MQTT 5 topic alias instead of crashing (GHSA-c8jq-r765-cq7g)