HIGH7.5

GHSA-hg78-c92r-hvwr

Denial of Service in mqtt

Quick fix

GHSA-hg78-c92r-hvwr — mqtt: upgrade to the fixed version with the command below.

npm install mqtt@1.0.0

Details

Affected versions of `mqtt` will cause the node process to crash when receiving specially crafted MQTT packets, making the application vulnerable to a denial of service condition.

## Recommendation

Update to v1.0.0 or later

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/mqtt

Introduced in: 0Fixed in: 1.0.0

Fixnpm install mqtt@1.0.0

References

https://nvd.nist.gov/vuln/detail/CVE-2016-1000242[ADVISORY]
https://github.com/mqttjs/MQTT.js[PACKAGE]
https://github.com/mqttjs/MQTT.js/blob/388a084d7803934b18b43c1146c817deaa1396b1/lib/parse.js#L230[WEB]
https://snyk.io/vuln/npm:mqtt:20160817[WEB]
https://www.npmjs.com/advisories/140[WEB]