Aedes MQTT broker can crash when it receives a topic that is deeply nested. The broker fails to bound topic depth or structural complexity before sending topics to the qlobber module, which triggers an uncaught "too many words" exception in qlobber._split_words. This exception, an unchecked exception (CWE-248), escapes to the Node.js event loop and terminates the broker, causing all clients to lose connectivity. The same flaw also applies when a client disconnects ungracefully and the server publishes the Will message directly, bypassing the standard PUBLISH handler. The result is a denial of service that persists until the broker process restarts, reflecting uncontrolled resource consumption (CWE-400).

The vulnerability affects the Aedes MQTT broker from the moscajs project. All installations of Aedes prior to version 1.1.1 are impacted regardless of the broker configuration. Users running any MQTT broker instance that depends on Aedes need to check their current version.

The CVSS score is 7.5, reflecting substantial impact. The EPSS score is not available, so the likelihood is uncertain. It is not listed in the CISA KEV catalog. An attacker must be able to establish a session with the broker, either authenticated or unauthenticated based on the broker configuration. Once connected, the attacker sends a PUBLISH, SUBSCRIBE, or Will message containing an overly deep topic string. The unfettered recursion in qlobber causes an uncaught exception that propagates to the process level, immediately terminating the broker. The attack is straightforward and does not require additional setup beyond the ability to send a message to the broker.