Executive brief
MQTT.js is a Node.js library used to implement MQTT protocol communication for IoT and messaging applications. An attacker can crash the Node.js process by sending specially crafted MQTT packets, causing service outages and disrupting dependent applications.
Technical details
The vulnerability is a denial of service (CWE-248) in the MQTT packet parsing logic (lib/parse.js). When the mqtt library receives specially crafted MQTT packets over the network, improper error handling causes an uncaught exception that crashes the Node.js process. No authentication is required; an unauthenticated attacker on the network can trigger the crash. The fix is available in version 1.0.0 and later.
Affected products
- mqttjs MQTT.js < 1.0.0
Timeline
- 2020-09-01: disclosed
- 1.0.0: patched: Fix available in version 1.0.0