There's a closed pull request on the void-packages repository

mosquitto: update to 1.6.12
https://github.com/void-linux/void-packages/pull/26499

Description:
Fixes CVE-2019-11778 CVE-2019-11779