Live › vulnerability › CVE-2026-63341
Aedes is an MQTT broker library for Node.js that does not limit topic depth before passing topics to its matching code. A crafted PUBLISH, SUBSCRIBE, or Will message with an excessively deep topic throws an uncaught exception that terminates the broker, disconnecting all clients until restart.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 23:26 UTC. All times on this page are UTC.
Any service that runs the Aedes MQTT broker on Node.js, prior to 1.1.1, is exposed. An attacker needs to open an MQTT session, which may be possible without authentication depending on broker configuration. Teams that only use a hosted MQTT service or that do not run Aedes can skip it.
No product ranges from the sources yet.
npm ls aedes.aedes in package.json and lockfiles to see which services depend on it.1.1.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through mqemitter into qlobber. A PUBLISH, SUBSCRIBE, or registered Will message containing an excessively deep topic can reach qlobber._split_words in lib/qlobber.js and trigger an uncaught too many words exception. Calls from handlers/subscribe.js and the publishing logic are not protected against that exception, so it escapes to the Node.js event loop and terminates the entire broker. The Will path is independently reachable when a client disconnects ungracefully: it calls broker.publish directly and bypasses the PUBLISH handler. An attacker must be able to establish an MQTT session, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-63341")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.