CVE-2026-63341: Aedes has Uncaught Exception and Uncontrolled Resource Consumption
Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through mqemitter into qlobber. A PUBLISH, SUBSCRIBE, or registered Will message containing an excessively deep topic can reach qlobber.splitwords in lib/qlobber.js and trigger an uncaught too many words exception. Calls from handlers/subscribe.js and the publishing logic are not protected against that exception, so it escapes to the Node.js event loop and terminates the entire broker. The Will path is independently reachable when a client disconnects ungracefully: it calls broker.publish directly and bypasses the PUBLISH handler. An attacker must be able to establish an MQTT session, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.
Event History
Frequently Asked Questions
What access does an attacker need to disrupt the broker?
The attacker must be able to establish an MQTT session. Whether that requires credentials depends on the broker's authentication configuration; no other privileges or user interaction are required.
Which MQTT operations can trigger the broker crash?
An excessively deep topic in a PUBLISH or SUBSCRIBE message can trigger the uncaught exception. A registered Will message can also trigger it when the client disconnects ungracefully, through a separate path that calls broker.publish directly.
What is the operational impact of successful exploitation?
The uncaught exception escapes to the Node.js event loop and terminates the entire broker process. All connected clients are disconnected and cannot reconnect until the process restarts.
What version contains the fix?
The issue is fixed in Aedes version 1.1.1. Versions prior to 1.1.1 are affected.