Launchpad.net

CVE 2017-10910

MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tickets may lead to an attacker causing a denial-of-service condition.

See the CVE page on Mitre.org for more details.