What is GHSA-hg78-c92r-hvwr?

GHSA-hg78-c92r-hvwr is a security advisory published by GitHub Security Advisories with High severity. Denial of Service in mqtt

Which CVE IDs does GHSA-hg78-c92r-hvwr cover?

GHSA-hg78-c92r-hvwr covers the following CVE IDs: CVE-2016-1000242. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hg78-c92r-hvwr?

GHSA-hg78-c92r-hvwr has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-hg78-c92r-hvwr?

GHSA-hg78-c92r-hvwr affects 1 product, including: npm/mqtt:\u003c= 0.3.13.

GHSA-hg78-c92r-hvwrHighCVSS 7.5

Denial of Service in mqtt

Vendor

GitHub Security Advisories

Published

September 1, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2016-1000242 →

📋 Description

Affected versions of mqtt will cause the node process to crash when receiving specially crafted MQTT packets, making the application vulnerable to a denial of service condition.

Recommendation

Update to v1.0.0 or later

🎯 Affected products1

npm/mqtt:<= 0.3.13

🔗 References (5)

https://github.com/mqttjs/MQTT.js/blob/388a084d7803934b18b43c1146c817deaa1396b1/lib/parse.js#L230
https://www.npmjs.com/advisories/140
https://nvd.nist.gov/vuln/detail/CVE-2016-1000242
https://snyk.io/vuln/npm:mqtt:20160817
https://github.com/advisories/GHSA-hg78-c92r-hvwr