Release 1.1.3

Security

GHSA-52qw-whmv-87c5 — remote unauthenticated denial of service (high).

A single MQTT packet using an Object.prototype property name as a topic filter or Client ID crashed the broker process. Unauthenticated under the default hooks; every connected client is dropped and no new connections are accepted until a supervisor restarts the process.

Reachable via SUBSCRIBE, UNSUBSCRIBE or CONNECT, and in a cluster it propagated to every peer broker. See the advisory for the triggers and full analysis.

client.subscriptions, client.duplicates, Aedes.clients and Aedes.brokers are now Object.create(null), and the SUBSCRIBE dedupe map is a real Map.

Upgrade to 1.1.3. The 2.0.0-beta line is still affected — there is no patched 2.x release yet.

Behaviour change for consumers

broker.clients and client.subscriptions no longer inherit from Object.prototype:

• clients.hasOwnProperty(id) throws — use Object.hasOwn(clients, id) or id in clients
• String(clients) throws; clients instanceof Object is false
• util.inspect prints [Object: null prototype]

Object.keys, for...in, delete, JSON.stringify and spread are unaffected.

Reported by @NotAFlightRisk and @Un-Locksmith.

Commits

• fix: reject prototype-named topics and client IDs (GHSA-52qw-whmv-87c5) (9a1686b)
• fix: type LastHearthbeatTimestamp as number (#1151) (66506bc)