Read the docs
TI-2017-07999 Aliases CVE-2017-10910GHSA-h9mj-fghc-664w

Uncontrolled recursion in MQTT.js. MQTT.js

Priority LOW 33CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-674.

Summary

MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition.

Why it matters now

EPSS 0.02257 83rd percentileScored 2026-11-07
Fix Fixed MQTT.js (MQTT.js.): 2.15.0mqtt (npm): 2.15.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MQTT.js.MQTT.js2.x to before 2.15.02.15.0Patch availableCNA
—mqtt (npm)2.0.0 to before 2.15.02.15.0Patch availableGHSA-h9mj-fghc-664w
  • MQTT.js VendorMQTT.js. Affected 2.x to before 2.15.0 Fixed in 2.15.0 Patch available CNA
  • mqtt (npm) Vendor— Affected 2.0.0 to before 2.15.0 Fixed in 2.15.0 Patch available GHSA-h9mj-fghc-664w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mqtt.js_project:mqtt.js:*:*:*:*:*:node.js:*:*2.0.0 to before 2.15.0VulnerableMqtt.js Project
  • cpe:2.3:a:mqtt.js_project:mqtt.js:*:*:*:*:*:node.js:*:* Versions 2.0.0 to before 2.15.0 Vulnerable ·Mqtt.js Project

Remediation

  • Fix · CNA MQTT.js (MQTT.js.) Fixed in 2.15.0
  • Fix · GHSA-h9mj-fghc-664w mqtt (npm) Fixed in 2.15.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-10910
  2. 2026-10-03 Alias added: GHSA-h9mj-fghc-664w

References

Patch 1

Advisory 4

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences