TI-2018-08303 Aliases CVE-2018-11615 GHSA-wqg7-vrj7-v82h

Improper input validation in npm mosca

LOW 39CWE-20Published 2018-08-30 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306.

Why it matters now

EPSS 0.03219 88th percentileScored 2026-11-07

Fix Fixed mosca (npm): 2.8.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
npm	npm mosca	2.8.1	—	No fix listed	CNA
—	mosca (npm)	before 2.8.2	2.8.2	Patch available	GHSA-wqg7-vrj7-v82h

npm mosca Vendornpm Affected 2.8.1 Fixed in — No fix listed CNA
mosca (npm) Vendor— Affected before 2.8.2 Fixed in 2.8.2 Patch available GHSA-wqg7-vrj7-v82h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mosca_project:mosca:2.8.1:::::node.js::	2.8.1	Vulnerable	Mosca Project

cpe:2.3:a:mosca_project:mosca:2.8.1:*:*:*:*:node.js:*:* Versions 2.8.1 Vulnerable ·Mosca Project

Remediation

Fix · GHSA-wqg7-vrj7-v82h mosca (npm) Fixed in 2.8.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2018-11615
2026-10-03 Alias added: GHSA-wqg7-vrj7-v82h

References

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences