Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Affected versions of mqtt will cause the node process to crash when receiving specially crafted MQTT packets, making the application vulnerable to a denial of service condition. Recommendation Update to v1.0.0 or later
Recommended action: Upgrade to 1.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of mqtt do not properly handle PUBLISH packets returning from the server, leading to a Denial of Service condition. The vulnerability is completely mitigated if the only connected servers are trusted, guaranteed not to be under the control of a malicious actor. Proof of Concept The following is a demonstration of how to generate the malicious packet sequence, but does not include information on handling the initial network connections and MQTT overhead. Recommendation Update to version 2.15.0 or later.
Recommended action: Upgrade to 2.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.