# aedes incorrect authorization in Last Will processing

Source: https://junglewise.ai/threats/aedes-incorrect-authorization-in-last-will-processing-90e624d7  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-02-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2021-02-23

aedes is a Node.js MQTT broker library used to build message-oriented applications. Versions before 0.35.1 bypass their own authorization rules when a client sets a Last Will message, allowing authenticated users to publish messages to restricted topics that they should not have access to. This could result in unauthorized message publication, data exposure, or system compromise depending on the message contents and topic restrictions.

Technologies: [aedes (npm)](https://junglewise.ai/threats/technologies/aedes). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 23 February 2021.

**Which products and versions are affected?** aedes (npm) 0.1.0 to 0.35.0.

**Is there a fix for This vulnerability?** A patch was published on 0.35.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run aedes (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in aedes's Last Will functionality. When an MQTT client sets a Last Will message (a message that is automatically published by the broker upon the client's unexpected disconnection), the broker fails to validate whether the client has permission to publish to the target topic. An authenticated client can exploit this by setting a Last Will message to a restricted topic they do not have publish access to; the message will be delivered after disconnection despite the authorization failure. The attack requires valid client authentication but no user interaction. The vulnerability was fixed in commit ffbc170 by implementing proper authorization checks before accepting Last Will messages. Affected versions include all releases from 0.1.0 up to and including 0.35.0.

## Affected products

- npm aedes 0.1.0 to 0.35.0

## Timeline

- 2021-02-23: disclosed
- 0.35.1: patched

## References

- [https://github.com/mcollina/aedes/issues/211](https://github.com/mcollina/aedes/issues/211)
- [https://github.com/mcollina/aedes/commit/ffbc1702bb24b596afbb96407cc6db234a4044a8](https://github.com/mcollina/aedes/commit/ffbc1702bb24b596afbb96407cc6db234a4044a8)

## Related threats

- [Aedes improper exception handling in packet write](https://junglewise.ai/threats/cve-2020-13410-aedes-improper-exception-handling-in-packet-write)
- [aedes improper authorization in last will messages](https://junglewise.ai/threats/cve-2018-3778-aedes-improper-authorization-in-last-will-messages)