CVE-2026-63341

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through mqemitter into qlobber. A PUBLISH, SUBSCRIBE, or registered Will message containing an excessively deep topic can reach qlobber._split_words in lib/qlobber.js and trigger an uncaught too many words exception. Calls from handlers/subscribe.js and the publishing logic are not protected against that exception, so it escapes to the Node.js event loop and terminates the entire broker. The Will path is independently reachable when a client disconnects ungracefully: it calls broker.publish directly and bypasses the PUBLISH handler. An attacker must be able to establish an MQTT session, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through mqemitter into qlobber. A PUBLISH, SUBSCRIBE, or registered Will message containing an excessively deep topic can reach qlobber._split_words in lib/qlobber.js and trigger an uncaught too many words exception. Calls from handlers/subscribe.js and the publishing logic are not protected against that exception, so it escapes to the Node.js event loop and terminates the entire broker. The Will path is independently reachable when a client disconnects ungracefully: it calls broker.publish directly and bypasses the PUBLISH handler. An attacker must be able to establish an MQTT session, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through mqemitter into qlobber. A PUBLISH, SUBSCRIBE, or registered Will message containing an excessively deep topic can reach qlobber._split_words in lib/qlobber.js and trigger an uncaught too many words exception. Calls from handlers/subscribe.js and the publishing logic are not protected against that exception, so it escapes to the Node.js event loop and terminates the entire broker. The Will path is independently reachable when a client disconnects ungracefully: it calls broker.publish directly and bypasses the PUBLISH handler. An attacker must be able to establish an MQTT session, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through mqemitter into qlobber. A PUBLISH, SUBSCRIBE, or registered Will message containing an excessively deep topic can reach qlobber._split_words in lib/qlobber.js and trigger an uncaught too many words exception. Calls from handlers/subscribe.js and the publishing logic are not protected against that exception, so it escapes to the Node.js event loop and terminates the entire broker. The Will path is independently reachable when a client disconnects ungracefully: it calls broker.publish directly and bypasses the PUBLISH handler. An attacker must be able to establish an MQTT session, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.