---
id: "CVE-2026-63341"
kind: "vulnerability"
aliases: ["CVE-2026-63341"]
title: "Aedes MQTT broker: deep topic crashes the whole broker process"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aedes", "iot", "mqtt", "node.js", "package"]
not_affected_if: ["aedes-1.1.1-or-later", "managed-mqtt-service"]
published_at: "2026-10-30T23:17:13+00:00"
first_seen_at: "2026-10-30T23:26:12+00:00"
updated_at: "2026-10-30T23:28:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63341", "first_seen_at": "2026-10-30T23:26:12+00:00"}]
---

# Aedes MQTT broker: deep topic crashes the whole broker process

Aedes is an MQTT broker library for Node.js that does not limit topic depth before passing topics to its matching code. A crafted PUBLISH, SUBSCRIBE, or Will message with an excessively deep topic throws an uncaught exception that terminates the broker, disconnecting all clients until restart.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Aedes version in the project, for example `npm ls aedes`.
- Look for `aedes` in `package.json` and lockfiles to see which services depend on it.
- Confirm whether the broker accepts connections from untrusted clients, since an attacker must be able to open an MQTT session.

## Fix

- Aedes: move to `1.1.1` or later.

## Timeline

- 2026-10-30T23:26:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63341

## From the sources

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will` message containing an excessively deep topic can reach `qlobber._split_words` in `lib/qlobber.js` and trigger an uncaught `too many words` exception. Calls from `handlers/subscribe.js` and the publishing logic are not protected against that exception, so it escapes to the `Node.js event loop` and terminates the entire broker. The `Will` path is independently reachable when a client disconnects ungracefully: it calls `broker.publish` directly and bypasses the `PUBLISH` handler. An attacker must be able to establish an `MQTT session`, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_