Node Opcua
Monthly
Socket and memory exhaustion in node-opcua clients (packages node-opcua, node-opcua-client and node-opcua-transport, versions 2.0.0 through 2.169.x) can terminate the Node.js process or container via OOM kill when the client is configured with the default keepSessionAlive: true and connects to an OPC UA server whose clock is skewed well beyond the server's RequestHeader timestamp tolerance. Two compounding defects cause this: the keepalive manager misclassifies the server's BadInvalidTimestamp status code as a network outage and forces a full transport reconnection on every keepalive cycle, while the HEL/ACK failure handler calls socket.end() instead of socket.destroy(), leaving each abandoned connection in FIN-WAIT-2 so leaked sockets accumulate roughly once per keepAliveInterval (about 1,200 per hour at the default 3-second interval). The vector is network-reachable and unauthenticated (PR:N), but exploitation is high-complexity and conditional on clock skew plus a peer that never completes the TCP close; no public exploit code or confirmed active exploitation was identified at time of analysis, and impact is confined to availability of the affected client process (C:N/I:N/A:H).
Prototype pollution in node-opcua-client versions prior to 2.145.0 lets an attacker who controls OPC UA event or condition field names corrupt Object.prototype through the internal fieldsToJson helper in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts, which assigns unsanitized field names and permits a __proto__.pollutedKey assignment path. Only host applications that feed attacker-controlled event field names into that serialization helper are exposed; a malicious or compromised OPC UA server (or untrusted publisher) must supply the crafted field name AND the application must omit field-name sanitization, which is why the vendor rates attack complexity as high. There is no public exploit identified at time of analysis and no confirmed remote code execution - impact is bounded to denial of service or application logic corruption with no confidentiality exposure, making this a genuinely low-priority issue despite being a real prototype-pollution flaw. The issue is unauthenticated per the CVSS vector (PR:N) and is fixed in 2.145.0.
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Socket and memory exhaustion in node-opcua clients (packages node-opcua, node-opcua-client and node-opcua-transport, versions 2.0.0 through 2.169.x) can terminate the Node.js process or container via OOM kill when the client is configured with the default keepSessionAlive: true and connects to an OPC UA server whose clock is skewed well beyond the server's RequestHeader timestamp tolerance. Two compounding defects cause this: the keepalive manager misclassifies the server's BadInvalidTimestamp status code as a network outage and forces a full transport reconnection on every keepalive cycle, while the HEL/ACK failure handler calls socket.end() instead of socket.destroy(), leaving each abandoned connection in FIN-WAIT-2 so leaked sockets accumulate roughly once per keepAliveInterval (about 1,200 per hour at the default 3-second interval). The vector is network-reachable and unauthenticated (PR:N), but exploitation is high-complexity and conditional on clock skew plus a peer that never completes the TCP close; no public exploit code or confirmed active exploitation was identified at time of analysis, and impact is confined to availability of the affected client process (C:N/I:N/A:H).
Prototype pollution in node-opcua-client versions prior to 2.145.0 lets an attacker who controls OPC UA event or condition field names corrupt Object.prototype through the internal fieldsToJson helper in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts, which assigns unsanitized field names and permits a __proto__.pollutedKey assignment path. Only host applications that feed attacker-controlled event field names into that serialization helper are exposed; a malicious or compromised OPC UA server (or untrusted publisher) must supply the crafted field name AND the application must omit field-name sanitization, which is why the vendor rates attack complexity as high. There is no public exploit identified at time of analysis and no confirmed remote code execution - impact is bounded to denial of service or application logic corruption with no confidentiality exposure, making this a genuinely low-priority issue despite being a real prototype-pollution flaw. The issue is unauthenticated per the CVSS vector (PR:N) and is fixed in 2.145.0.
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.