CVE-2020-13410: Improper exception handling in Aedes
Summary
CVE-2020-13410: Improper exception handling in Aedes. Affects aedes versions < 0.42.1. Fixed in 0.42.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Aedes is an npm package that provides a MQTT broker implementation. It allows devices to communicate with each other using the MQTT protocol. Aedes version 0.42.0 is affected by a vulnerability that could lead to improper exception handling in the lib/write.js file. This vulnerability can be exploited when writing an invalid packet to a stream.
Vulnerability Detail
The vulnerability in Aedes version 0.42.0 arises from the improper handling of exceptions during the writing of an invalid packet to a stream. This can result in unexpected behavior or crashes in the application using Aedes. An attacker could potentially exploit this vulnerability to disrupt the MQTT communication or execute arbitrary code on the affected system.
How To Fix
Latest published version: 1.2.0 as of 23 Oct 2026
npm install aedes@1.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.42.1
This is the first release that contains the fix.
npm install aedes@0.42.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Aedes to mitigate the risk.
Conclusion
In conclusion, the vulnerability in Aedes version 0.42.0 can result in improper exception handling when writing an invalid packet to a stream. It is recommended to upgrade to Aedes version 0.42.1 or later to fix this vulnerability. No workaround is available, and it is crucial to take immediate action to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aedes →
FAQ
Aedes is an npm package that provides a MQTT broker implementation, allowing devices to communicate using the MQTT protocol.
The vulnerability can lead to unexpected behavior or crashes in the application using Aedes. An attacker could potentially disrupt MQTT communication or execute arbitrary code on the affected system.
To fix this vulnerability, upgrade to Aedes version 0.42.1 or later by updating your package.json file and running the package manager to install the updated package.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of Aedes.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-gh78-48h3-frjq/GHSA-gh78-48h3-frjq.json
References
Related vulnerabilities
Recent vulnerabilities recorded for aedes.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
