---
id: CVE-2026-63341
title: Aedes has Uncaught Exception and Uncontrolled Resource Consumption
summary: >-
  Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the
  MQTT broker does not bound topic depth or structural complexity before passing
  topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or
  registe…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-248
  - CWE-400
vendor: moscajs
product: aedes
affected:
  - aedes < 1.1.1
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-05T02:56:48.899765Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T02:57:11.142Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63341'
references:
  - url: 'https://github.com/moscajs/aedes/security/advisories/GHSA-xxqp-5qx8-gj5q'
    label: 'https://github.com/moscajs/aedes/security/advisories/GHSA-xxqp-5qx8-gj5q'
  - url: >-
      https://github.com/moscajs/aedes/commit/b9024faa4cb416c4c6980760b4d7f55336315f2d
    label: >-
      https://github.com/moscajs/aedes/commit/b9024faa4cb416c4c6980760b4d7f55336315f2d
  - url: 'https://github.com/moscajs/aedes/releases/tag/v1.1.1'
    label: 'https://github.com/moscajs/aedes/releases/tag/v1.1.1'
tags:
  - cve.org
  - exploit-available
epss: 0.00365
epssPercentile: 0.30485
ingestedAt: '2026-11-05T21:36:00.718Z'
---

## Overview

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will` message containing an excessively deep topic can reach `qlobber._split_words` in `lib/qlobber.js` and trigger an uncaught `too many words` exception. Calls from `handlers/subscribe.js` and the publishing logic are not protected against that exception, so it escapes to the `Node.js event loop` and terminates the entire broker. The `Will` path is independently reachable when a client disconnects ungracefully: it calls `broker.publish` directly and bypasses the `PUBLISH` handler. An attacker must be able to establish an `MQTT session`, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.

## Affected

- `aedes < 1.1.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.