CVE-2026-63341

Received Received - Intake

Denial of Service in Aedes MQTT Broker

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will` message containing an excessively deep topic can reach `qlobber._split_words` in `lib/qlobber.js` and trigger an uncaught `too many words` exception. Calls from `handlers/subscribe.js` and the publishing logic are not protected against that exception, so it escapes to the `Node.js event loop` and terminates the entire broker. The `Will` path is independently reachable when a client disconnects ungracefully: it calls `broker.publish` directly and bypasses the `PUBLISH` handler. An attacker must be able to establish an `MQTT session`, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63341

Affected Vendors & Products

Vendor	Product	Version / Range
moscajs	aedes	< 1.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects Aedes, an MQTT broker, where excessively deep MQTT topics can cause an uncaught exception in the qlobber library. This leads to the broker crashing and disconnecting all clients until it restarts.

Detection Guidance

Detecting this vulnerability requires checking the Aedes MQTT broker version. Run: npm list aedes to verify if the installed version is below 1.1.1. Monitor broker logs for 'too many words' exceptions during PUBLISH, SUBSCRIBE, or Will message processing.

Impact Analysis

An attacker can exploit this to crash the MQTT broker, disconnecting all legitimate clients and preventing reconnection until the broker process is manually restarted. This disrupts MQTT-based services and communication.

Mitigation Strategies

Upgrade Aedes to version 1.1.1 or later immediately. If upgrading is not possible, restrict MQTT session establishment by enforcing authentication and limiting client connections. Monitor broker stability and restart processes if crashes occur.

Hi! I’m here to help you understand CVE-2026-63341. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70