Uncontrolled resource consumption in HackerOne mqtt-packet node module
Priority LOW 37CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth.
Why it matters now
EPSS 0.0242 84th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed mqtt-packet (npm): 3.4.6, 4.0.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HackerOne | mqtt-packet node module | <3.4.6 || > 4.0.0 <4.0.5 | — | No fix listed | CNA |
| — | mqtt-packet (npm) | before 3.4.6 | 3.4.6 | Patch available | GHSA-g3r2-65gc-qpqc |
| — | mqtt-packet (npm) | 4.0.0 to before 4.0.5 | 4.0.5 | Patch available | GHSA-g3r2-65gc-qpqc |
- mqtt-packet node module VendorHackerOne Affected <3.4.6 || > 4.0.0 <4.0.5 Fixed in — No fix listed CNA
- mqtt-packet (npm) Vendor— Affected before 3.4.6 Fixed in 3.4.6 Patch available GHSA-g3r2-65gc-qpqc
- mqtt-packet (npm) Vendor— Affected 4.0.0 to before 4.0.5 Fixed in 4.0.5 Patch available GHSA-g3r2-65gc-qpqc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mqtt-packet_project:mqtt-packet:*:*:*:*:*:node.js:*:* | before 3.4.6; 4.0.0 to before 4.0.5 | Vulnerable | Mqtt-packet Project |
- cpe:2.3:a:mqtt-packet_project:mqtt-packet:*:*:*:*:*:node.js:*:* Versions before 3.4.6; 4.0.0 to before 4.0.5 Vulnerable ·Mqtt-packet Project
Remediation
- Fix · GHSA-g3r2-65gc-qpqc mqtt-packet (npm) Fixed in 3.4.6 Advisory →
- Fix · GHSA-g3r2-65gc-qpqc mqtt-packet (npm) Fixed in 4.0.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2016-10523
- 2026-10-03 Alias added: GHSA-g3r2-65gc-qpqc
References
More Mqtt-packet Project Mqtt-packet vulnerabilities
- TI-2019-03841 Out-of-bounds read in mqtt-packet CVSS 3.1HIGH 7.5
Sources
- CVE-2016-10523 · CVE Program
- CVE-2016-10523 · NVD
- FIRST EPSS
- GHSA-g3r2-65gc-qpqc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences