6vulnerabilities
- Critical0 (0.0%)
- High6 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
node-opcua
Ecosystem: npm
Downloads: 314.95 K
- 0CriticalAffects 0 versions
- 6HighAffects 6 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 2 vulnerabilities
- Critical: 0
- High: 2
- Medium: 0
- Moderate: 0
- Low: 0
- 3 vulnerabilities
- Critical: 0
- High: 3
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (6)
Known vulnerabilities affecting node-opcua, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-r2pf-9cw4-5j65 | High | node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource ExhaustionSUMMARY ------- A combination of bugs in node-opcua causes unlimited TCP socket accumulation (FIN-WAIT-2 state) during automatic reconnection, leading to memory exhaustion and eventual container/process crash (OOM kill). The issue is triggered by the default configuration (keepSessionAlive: true) when the OPC UA server has clock skew relative to the client. Affected version: Tested on 2.169.0 (latest as of April 2026). ENVIRONMENT ----------- - Node.js: v24.11.0 - node-opcua: 2.169.0 - OS: Linux (containerized via Podman, slirp4netns networking) - OPC UA Server: Industrial PLC (opc.tcp endpo |
| GitHub (opens in a new tab) | |
| GHSA-6wvw-vrw4-363w | High | node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS**Summary** A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. **Affected versions:** <= 2.165.0 **Tested version:** 2.165.0 **CVSS Score:** 7.5 (High) **CVSS Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H **CWE:** CWE-770 Allocation of Resources Without Limits or Throttling --- **Root Cause** In `packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts` at line 156, `g_alreadyUsedNonce` is a process-global |
| GitHub (opens in a new tab) | |
| GHSA-mq36-523m-x7vv | High | node-opcua missing nonce verification in UserNameIdentityToken authentication**Summary** A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. **Affected versions:** <= 2.165.0 **Tested version:** 2.165.0 **CVSS Score:** 8.1 (High) **CVSS Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L **CWE:** CWE-347 Improper Verification of Cryptographic Signature --- **Root Cause** In `packages/node-opcua-server/source/opcua_server.ts` at line 1886-1887, after RSA-OAEP decrypting the |
| GitHub (opens in a new tab) | |
| GHSA-vh4f-fgpp-x8x2 | High | node-opcua DoS when bypassing limitations for excessive memory consumptionThe package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple `CloseSession` requests with the `deleteSubscription` parameter equal to `False`. |
| GitHub (opens in a new tab) | |
| GHSA-4hr4-pjjh-2q2w | High | Uncontrolled Resource Consumption in node-opcuaThe package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk. |
| GitHub (opens in a new tab) | |
| GHSA-qpgc-xh7j-52q8 | High | node-opcua DoS vulnerability via message with memory allocation that exceeds v8's memory limitThe package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit. |
| GitHub (opens in a new tab) |
- GHSA-r2pf-9cw4-5j65Highnode-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
>= 2.0.0, < 2.170.0
SUMMARY ------- A combination of bugs in node-opcua causes unlimited TCP socket accumulation (FIN-WAIT-2 state) during automatic reconnection, leading to memory exhaustion and eventual container/process crash (OOM kill). The issue is triggered by the default configuration (keepSessionAlive: true) when the OPC UA server has clock skew relative to the client. Affected version: Tested on 2.169.0 (latest as of April 2026). ENVIRONMENT ----------- - Node.js: v24.11.0 - node-opcua: 2.169.0 - OS: Linux (containerized via Podman, slirp4netns networking) - OPC UA Server: Industrial PLC (opc.tcp endpo
CVE: CVE-2026-68904
- GHSA-6wvw-vrw4-363wHighnode-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
< 2.166.0
**Summary** A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. **Affected versions:** <= 2.165.0 **Tested version:** 2.165.0 **CVSS Score:** 7.5 (High) **CVSS Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H **CWE:** CWE-770 Allocation of Resources Without Limits or Throttling --- **Root Cause** In `packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts` at line 156, `g_alreadyUsedNonce` is a process-global
CVE: CVE-2026-54156
- GHSA-mq36-523m-x7vvHighnode-opcua missing nonce verification in UserNameIdentityToken authentication
<= 2.165.0
**Summary** A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. **Affected versions:** <= 2.165.0 **Tested version:** 2.165.0 **CVSS Score:** 8.1 (High) **CVSS Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L **CWE:** CWE-347 Improper Verification of Cryptographic Signature --- **Root Cause** In `packages/node-opcua-server/source/opcua_server.ts` at line 1886-1887, after RSA-OAEP decrypting the
CVE: CVE-2026-54155
- GHSA-vh4f-fgpp-x8x2Highnode-opcua DoS when bypassing limitations for excessive memory consumption
< 2.74.0
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple `CloseSession` requests with the `deleteSubscription` parameter equal to `False`.
CVE: CVE-2022-24375
- GHSA-4hr4-pjjh-2q2wHighUncontrolled Resource Consumption in node-opcua
< 2.74.0
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.
CVE: CVE-2022-21208
- GHSA-qpgc-xh7j-52q8Highnode-opcua DoS vulnerability via message with memory allocation that exceeds v8's memory limit
< 2.74.0
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit.
CVE: CVE-2022-25231