CVE-2026-63341

The Aedes MQTT broker (prior to version 1.1.1 ) is vulnerable to a Denial of Service (DoS) due to missing bounds on topic depth and structural complexity . When a PUBLISH, SUBSCRIBE, or Will message contains an excessively deep topic, it reaches qlobber._split_words in lib/qlobber.js, triggering ...

CVE-2026-63341: moscajs aedes: Aedes is an MQTT broker that can run on any stream server

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through mqemitter into qlobber. A PUBLISH, SUBSCRIBE, or registered Will message containing an excessively deep topic can reach...