CVE-2016-1000242: Denial of Service in mqtt
Summary
CVE-2016-1000242: Denial of Service in mqtt. Affects mqtt versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mqtt package is an npm package that provides a client implementation of the MQTT protocol, allowing applications to connect to MQTT brokers and exchange messages. MQTT is a lightweight messaging protocol commonly used in IoT applications. The mqtt package is widely used in Node.js applications for MQTT communication.
Vulnerability Detail
Affected versions of mqtt are vulnerable to a denial of service (DoS) attack. When the package receives specially crafted MQTT packets, it causes the node process to crash, leading to a DoS condition. This vulnerability can be exploited by an attacker to disrupt the availability of the application.
How To Fix
Latest published version: 5.16.1 as of 23 Oct 2026
npm install mqtt@5.16.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
npm install mqtt@1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The mqtt package is vulnerable to a denial of service attack. To mitigate this vulnerability, it is crucial to update to version 1.0.0 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for mqtt →
FAQ
The vulnerability allows an attacker to send specially crafted MQTT packets, causing the node process to crash and leading to a denial of service condition. This can result in the unavailability of the application and disruption of its functionality.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
No specific workaround is mentioned for this vulnerability. It is recommended to update to the latest version of the mqtt package to fix the issue.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-hg78-c92r-hvwr/GHSA-hg78-c92r-hvwr.json
Related vulnerabilities
Recent vulnerabilities recorded for mqtt.
