Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63341— Aedes has Uncaught Exception and Uncontrolled Resource Consumption

Quick assessment

Affected
moscajs aedes
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Aedes 是一个可在任何流式服务器上运行的 MQTT 代理。在 1.1.1 版本之前，该 MQTT 代理在将主题通过 传递至 之前，未对主题的层级深度或结构复杂度进行限制。若 、 或已注册的 （遗嘱消息）中包含过深的主题，该主题可能传入 中的 函数，从而触发一个未被捕获的"too many words"（词数过多）异常。由于 中的调用及发布逻辑均未对该异常进行防护，该异常会逃逸至 Node.js 事件循环，导致整个代理进程终止。此外， 消息路径可在客户端非正常断开时独立触发：它会直接调用 方法，从而绕过 消息处理

CVSS 7.5 · High EPSS 0.36% · P30

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Affected Version Matrix 1

VendorProduct Version RangeStatus
moscajs aedes < 1.1.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63341

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Aedes has Uncaught Exception and Uncontrolled Resource Consumption
Source: CVE Program / CVE List V5
Vulnerability Description
Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will` message containing an excessively deep topic can reach `qlobber._split_words` in `lib/qlobber.js` and trigger an uncaught `too many words` exception. Calls from `handlers/subscribe.js` and the publishing logic are not protected against that exception, so it escapes to the `Node.js event loop` and terminates the entire broker. The `Will` path is independently reachable when a client disconnects ungracefully: it calls `broker.publish` directly and bypasses the `PUBLISH` handler. An attacker must be able to establish an `MQTT session`, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
moscajs aedes < 1.1.1 -

II. Public POCs for CVE-2026-63341

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63341

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63341 (1)

Vendor Advisories for CVE-2026-63341 (1)

Vendor Pages for CVE-2026-63341 (1)

IV. Related Vulnerabilities

Same product: aedes
Same weakness: CWE-248