Security
This release fixes six advisories. All are reachable from a malicious or misbehaving broker — or anyone who can inject packets into a cleartext mqtt:// hop — with no special client configuration beyond speaking MQTT 5. Upgrade to 5.16.0; everything <= 5.15.2 is affected, including the v4 line, and there is no backport.
| Advisory | Severity | Impact |
|---|---|---|
| GHSA-c8jq-r765-cq7g | High | An unsolicited MQTT 5 Topic Alias throws an uncaught TypeError in the stream write path — kills the Node process, repeatable on every reconnect.
|
| GHSA-rj8f-4655-cgg2 | High | A SUBACK with the wrong number of reason codes crashes the process, or silently misreports which topics are subscribed. |
| GHSA-gfxc-3w7m-8ch4 | High | CONNACK properties were merged into the caller's own options object. A maximumPacketSize of 1 permanently kills the client, survives reconnects, and escapes to other clients built from the same options.
|
| GHSA-fwrw-4mhv-wxvm | High | A single unsolicited AUTH packet crashes the process on a default MQTT 5 client. Enhanced authentication did not have to be configured. |
| GHSA-8phv-jwjm-93rr | Medium | A duplicate CONNACK re-runs connection setup mid-session: in-flight QoS 1 resent under the same ids, all topics resubscribed, message-id state reset. |
| GHSA-h8jm-hm87-fqw3 | Low | The advertised receiveMaximum was ignored for inbound QoS 2, letting a broker grow the incoming store without bound. Reconnecting does not clear it.
|
Reproduction steps and full analysis stay in the advisories. CVE ids have been requested and will be added here once assigned.
Behaviour changes to check before upgrading
optionsis no longer mutated by a CONNACK. Code that read negotiated values back offoptions.properties.maximumPacketSizeoroptions.keepalivemust use the newclient.serverProperties/client.keepalivegetters instead.- A refused CONNACK now always closes the socket. With
reconnectOnConnackError: false(the default) the client previously sat on an open connection and kept deliveringmessageevents after telling the application the connection was refused. - Protocol violations now drop the connection: a SUBACK reason-code count mismatch, an invalid Topic Alias, an unsolicited or out-of-spec AUTH, and a broker exceeding
receiveMaximumon inbound QoS 2 (reason code0x93). Reconnect stays armed in all cases. - An ack that does not answer the command pending on that message id is dropped and reported via
error, instead of running the wrong completion path. - The unregistered-alias case now emits reason code
0x82(Protocol Error) instead of0x94. - AUTH reason code 0 ends the exchange successfully; previously it produced an error with an empty reason string.
properties.receiveMaximumoutside 1..65535, or not an integer, is ignored and 65535 is enforced and advertised instead.- The inbound packet-size cap now measures total wire size rather than Remaining Length, so it triggers on packets a few bytes smaller than before.
- New exports:
PacketPump(src/lib/shared.ts),PendingCommandfrom the entry point.
Reported by @afldl, @acorn421 and @hibrian827. Thanks to all three.
5.16.0 (2026-09-16)
Bug Fixes
- bounds-check the suback granted array against subscriptions sent (GHSA-rj8f-4655-cgg2) (#2061) (46ee23f), closes #2060
- enforce MQTT 5 Receive Maximum for inbound QoS 2 messages (GHSA-h8jm-hm87-fqw3) (#2065) (ec5bf3e), closes #2064 #2063 #2062 #2061 #2060
- keep broker CONNACK properties out of the user options object (GHSA-gfxc-3w7m-8ch4) (#2062) (3db16f5), closes #2061 #2060 #2060 #2060
- reject a duplicate CONNACK instead of re-running connection setup (GHSA-8phv-jwjm-93rr) (#2064) (7108ea5), closes #2063 #2062 #2061 #2060
- reject an unsolicited AUTH instead of crashing the process (GHSA-fwrw-4mhv-wxvm) (#2063) (b511e7b), closes #2062 #2061 #2060 #2060
- reject unsolicited MQTT 5 topic alias instead of crashing (GHSA-c8jq-r765-cq7g) (#2060) (7d07757)