node-opcua-client EUVD-2026-80867

Exploitation requires the host application built on node-opcua-client (< 2.145.0) to pass attacker-controlled OPC UA event/condition field names into the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts, where a field named to include a __proto__ path is assigned without sanitization. The limiting factors are significant: the attacker must control the OPC UA event source (a malicious or compromised server, or an untrusted publisher), and the application must not sanitize field names before serialization - this is not triggerable against a default configuration without that specific data flow, which is why the vendor assigns AC:H. Impact is bounded to denial of service or application logic corruption; there is no confidentiality exposure or confirmed remote code execution.

This is a genuinely low-priority issue despite being a real prototype-pollution flaw. The vendor CVSS of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) correctly captures a narrow, hard-to-reach weakness: exploitation is not a default-path condition but depends on the host application deliberately routing attacker-controlled OPC UA event fields into the internal fieldsToJson method, which justifies AC:H. No EPSS score, KEV entry, or public POC was supplied, so all exploitation signals point to no active or automatable exploitation. The impact ceiling is low - the description limits outcomes to denial of service or application logic corruption via Object.prototype tampering, with no confidentiality impact (C:N) and no direct code execution claimed. One tension to note: the CVSS shows AV:N/PR:N (network, unauthenticated), but the description makes clear a specific application coding pattern must exist for the malicious event to reach the vulnerable sink - the 'unauthenticated network' framing overstates reachability, and in practice OPC UA event delivery typically occurs within an established session. Treat this as a defense-in-depth library patch, not an urgent response item.

An OPC UA client application built on node-opcua subscribes to alarm/condition events from a server and passes the received event fields through fieldsToJson. A malicious or compromised OPC UA server sends an event containing a field named to traverse __proto__.pollutedKey, polluting Object.prototype and either crashing the client (DoS) or corrupting application logic that later reads the polluted property. No public exploit code has been identified at time of analysis, and success is gated on the application exposing attacker-controlled field names to the vulnerable method.