Aedes MQTT Broker Denial of Service (DoS) via Excessive Topic Depth (CVE-2026-63341)

1. Package Update

Update the Aedes dependency to the fixed version (1.1.1) using your package manager.

npm update aedes

2. Temporary Mitigation

• Process Management: Use a process manager like PM2 or Kubernetes LivenessProbes to ensure the broker restarts automatically upon a crash.
• Topic Filtering: Implement a custom validation layer in authorizePublish or authorizeSubscribe to reject topics exceeding a reasonable depth (e.g., 32 or 64 segments).

// Example validation
const MAX_DEPTH = 50;
if (topic.split('/').length > MAX_DEPTH) {
  // Reject the packet
}

The vulnerability stems from a lack of input validation regarding topic depth before passing data to the underlying qlobber library. When a PUBLISH, SUBSCRIBE, or Will message contains a topic with too many segments, qlobber._split_words in lib/qlobber.js throws a 'too many words' exception. Since Aedes handlers (e.g., handlers/subscribe.js) do not properly catch this exception, it bubbles up to the Node.js event loop, terminating the entire process. The Will message path is particularly dangerous as it can be triggered independently when a client disconnects ungracefully, bypassing standard publish handlers.