HIGH7.5

GHSA-gh78-48h3-frjq

Improper exception handling in Aedes

Quick fix

GHSA-gh78-48h3-frjq — aedes: upgrade to the fixed version with the command below.

npm install aedes@0.42.1

Details

An issue was discovered in MoscaJS Aedes 0.42.0 and fixed in 0.42.1. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/aedes

Introduced in: 0Fixed in: 0.42.1

Fixnpm install aedes@0.42.1

References

https://nvd.nist.gov/vuln/detail/CVE-2020-13410[ADVISORY]
https://github.com/moscajs/aedes/pull/493[WEB]
https://github.com/moscajs/aedes/commit/8d34ee5819cfc983d57e49b45d8c5ef70a76d79b[WEB]
https://payatu.com/advisory/dos-in-aedes-mqtt-broker[WEB]