Denial of Service in mqtt-packet

HIGH 7.5CVE-2016-10523 · GHSA-g3r2-65gc-qpqc · Published 31/05/2018 · updated 17/06/2026

In short

CVE-2016-10523 is a HIGH (CVSS 7.5) vulnerability affecting mqtt-packet (mqtt-packet project), mqtt-packet.
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.2% of all vulnerabilities.
Fix: update to 4.0.5, 3.4.6 or later.

Package	Affected versions	Patched versions
mqtt-packet mqtt-packet_project	`≥ 4.0.0, < 4.0.5< 3.4.6`	`4.0.53.4.6`
mqtt-packet npm	`≥ 4.0.0, < 4.0.5< 3.4.6`	`4.0.53.4.6`

Description

Versions of mqtt-packet prior to 3.4.6, or 4.x prior to 4.0.5 are affected by a denial of service vulnerability wherein specific sequences of MQTT packets can crash the application.

Recommendation

Version 3.x: Update to version 3.4.6 or later. Version 4.x: Update to version 4.0.5 or later.

NVD description

MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth.

References

nvd.nist.gov/vuln/detail/CVE-2016-10523 · ADVISORY
mcollina/mosca · WEB
mqttjs/mqtt-packet#8 · WEB
GitHub Advisory GHSA-g3r2-65gc-qpqc · ADVISORY
npmjs.com/advisories/75 · WEB
nodesecurity.io/advisories/75 · Third Party Advisory

More vulnerabilities in mqtt-packet

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free