CVE-2018-11615: Vulnerability in npm mosca
Summary
CVE-2018-11615: Mosca REDoS Vulnerability. Affects mosca versions < 2.8.2. Fixed in 2.8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
npm mosca is an open-source MQTT broker that allows devices to communicate with each other using the MQTT protocol. It provides a lightweight and efficient messaging system for IoT applications. However, a high severity vulnerability has been discovered in version 2.8.1 of mosca. This vulnerability allows remote attackers to deny service on vulnerable installations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics, where a crafted regular expression can cause the broker to crash. Exploiting this vulnerability can lead to a denial of access to the target system.
Vulnerability Detail
The vulnerability in mosca arises from a flaw in the processing of topics. By sending a specially crafted regular expression, an attacker can cause the MQTT broker to crash. This vulnerability can be exploited remotely without authentication, making it a serious security concern. The impact of this vulnerability is a denial of service, preventing legitimate users from accessing the system. It is important to note that this vulnerability affects mosca version 2.8.1 and prior.
How To Fix
Latest published version: 2.8.3 as of 22 Oct 2026
npm install mosca@2.8.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.2
This is the first release that contains the fix.
npm install mosca@2.8.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the latest version of mosca to mitigate the risk.
Conclusion
In conclusion, the vulnerability in npm mosca version 2.8.1 allows remote attackers to deny service by exploiting a flaw in the processing of topics. To mitigate this risk, it is crucial to update to the latest version of mosca (2.8.2 or later). This will ensure that the vulnerability is patched and the system is secure. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mosca →
FAQ
Mosca is an open-source MQTT broker that facilitates communication between devices using the MQTT protocol.
The vulnerability allows remote attackers to deny service on vulnerable installations, leading to a denial of access to the target system.
No, authentication is not required to exploit this vulnerability.
To fix this vulnerability, it is recommended to upgrade to the latest version of mosca (2.8.2 or later).
There are no known workarounds for this vulnerability. Updating to the latest version is the recommended solution.
