CVE-2018-3778: Improper Authorization in aedes
Summary
CVE-2018-3778: Improper Authorization in aedes. Affects aedes versions < 0.35.1. Fixed in 0.35.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The aedes package is an MQTT broker built on Node.js. It provides a lightweight and efficient implementation of the MQTT protocol, allowing devices to communicate with each other via publish-subscribe messaging. The package is widely used in IoT applications and other systems that require real-time messaging capabilities. However, versions of aedes before 0.35.1 have a vulnerability that compromises its authorization rules when a client sets a Last Will message.
Vulnerability Detail
The vulnerability in aedes versions prior to 0.35.1 arises from a failure to enforce its own authorization rules when a client sets a Last Will message. This means that even if the client's access should be restricted based on the defined rules, the client can still publish a Last Will message. This could lead to unauthorized access or information disclosure, depending on the specific authorization rules in place. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 1.2.0 as of 23 Oct 2026
npm install aedes@1.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.35.1
This is the first release that contains the fix.
npm install aedes@0.35.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update to the fixed version of the aedes package.
Conclusion
The aedes package has a vulnerability that allows clients to bypass authorization rules when setting a Last Will message. To mitigate this vulnerability, it is crucial to update to version 0.35.1 or later of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aedes →
FAQ
aedes is an MQTT broker built on Node.js, providing publish-subscribe messaging capabilities for IoT applications and other systems.
The vulnerability allows clients to bypass authorization rules and publish Last Will messages, potentially leading to unauthorized access or information disclosure.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
To fix the vulnerability, update the aedes package to version 0.35.1 or later.
There is no specific workaround mentioned for this vulnerability. Updating to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for aedes.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
