VDB
Sign up
HIGH7.5

GHSA-wv67-9jq7-8r69

Improper Input Validation and Buffer Over-read in mqtt-packet

Quick fix

GHSA-wv67-9jq7-8r69 — mqtt-packet: upgrade to the fixed version with the command below.

npm install mqtt-packet@3.5.1

Details

A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/mqtt-packet
Introduced in: 0Fixed in: 3.5.1
Fixnpm install mqtt-packet@3.5.1
npm/mqtt-packet
Introduced in: 4.0.0Fixed in: 4.1.3
Fixnpm install mqtt-packet@4.1.3
npm/mqtt-packet
Introduced in: 5.0.0Fixed in: 5.6.1
Fixnpm install mqtt-packet@5.6.1
npm/mqtt-packet
Introduced in: 6.0.0Fixed in: 6.1.2
Fixnpm install mqtt-packet@6.1.2

References