Skip to content
OpenAdvisories

Vendor

node-opcua

5 known vulnerabilities.

Products

node-opcua 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.0
    CVE-2026-68904

    node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

    node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp re…

    node-opcua node-opcua node-opcua node-opcua-client npm
  • High 7.5
    CVE-2026-54156

    node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

    node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces fro…

    node-opcua node-opcua node-opcua npm
  • High 7.7
    CVE-2026-54155

    node-opcua: Missing nonce verification in UserNameIdentityToken authentication

    node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing…

    node-opcua node-opcua node-opcua npm