Skip to content
OpenAdvisories

Package · npm

node-opcua

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Critical 9.1
    CVE-2026-95860

    node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

    node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePe…

    node-opcua node-opcua node-opcua node-opcua-address-space npm
  • High 7.0
    CVE-2026-68904

    node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

    node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp re…

    node-opcua node-opcua node-opcua node-opcua-client npm
  • High 7.5
    CVE-2026-54156

    node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

    node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces fro…

    node-opcua node-opcua node-opcua npm
  • High 7.7
    CVE-2026-54155

    node-opcua: Missing nonce verification in UserNameIdentityToken authentication

    node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing…

    node-opcua node-opcua node-opcua npm
  • High 7.5
    CVE-2022-24375

    Denial of Service (DoS)

    The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.

    node-opcua npm
  • High 7.5
    CVE-2022-21208

    Denial of Service (DoS)

    The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an …

    node-opcua npm
  • High 7.5
    CVE-2022-25231

    Denial of Service (DoS)

    The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit.

    node-opcua npm