CVE-2026-63341

Name of the Vulnerable Software and Affected Versions Aedes versions prior to 1.1.1

Description The MQTT broker fails to limit topic depth or structural complexity before processing topics through mqemitter into qlobber. A PUBLISH, SUBSCRIBE, or registered Will message with an excessively deep topic can trigger an uncaught too many words exception within the qlobber. split words function in lib/qlobber.js. Because the publishing logic and handlers/subscribe.js do not protect against this exception, it reaches the Node.js event loop and crashes the entire broker. The Will path can be triggered when a client disconnects ungracefully by calling broker.publish directly. An attacker with the ability to establish an MQTT session can use this to disconnect all legitimate clients and cause a denial of service until the process is restarted.

Recommendations Update to version 1.1.1.