Improper Input Validation and Buffer Over-read in mqtt-packet

HIGH 7.5CVE-2019-5432 · GHSA-wv67-9jq7-8r69 · Published 06/05/2019 · updated 17/06/2026

In short

CVE-2019-5432 is a HIGH (CVSS 7.5) vulnerability affecting mqtt-packet (mqtt-packet project), mqtt-packet.
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.3% of all vulnerabilities.
Fix: update to 3.5.1, 4.1.3, 5.6.1, 6.1.2 or later.

Package	Affected versions	Patched versions
mqtt-packet mqtt-packet_project	`≥ 4.0.0, ≤ 4.1.3≥ 5.0.0, ≤ 5.6.1≥ 6.0.0, ≤ 6.1.2< 3.5.1`	`3.5.1`
mqtt-packet npm	`≥ 4.0.0, < 4.1.3≥ 5.0.0, < 5.6.1≥ 6.0.0, < 6.1.2< 3.5.1`	`4.1.35.6.16.1.23.5.1`

Description

A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding.

NVD description

A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding.

References

nvd.nist.gov/vuln/detail/CVE-2019-5432 · ADVISORY
hackerone.com/reports/541354 · WEB

More vulnerabilities in mqtt-packet

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free