CVE-2016-1000242: 
JavaScript vulnerability analysis and mitigation

Jenkins Git Client Plugin versions 2.4.2 and earlier creates temporary files with predictable names, which could allow attackers to cause a denial of service condition (GitHub Advisory).

The vulnerability exists in the MQTT.js library versions 0.3.13 and earlier. When receiving specially crafted MQTT packets, the application becomes vulnerable to a denial of service condition that causes the node process to crash. The issue has a CVSS v3.1 base score of 7.5 (High severity) with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Unchanged, Confidentiality: None, Integrity: None, Availability: High (Snyk).

A successful exploitation of this vulnerability allows remote attackers to cause a complete denial of service by crashing the application process. The impact is limited to availability with no effect on confidentiality or integrity of the system (GitHub Advisory).

The vulnerability is remotely exploitable without requiring any privileges or user interaction. An attacker can trigger the denial of service condition by sending specially crafted MQTT packets to the target application (Snyk).

Users should upgrade to MQTT.js version 1.0.0 or later which contains the fix for this vulnerability (GitHub Advisory).