Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-69200 (GCVE-0-2026-69200)

Vulnerability from nvd – Published: 2026-09-16 16:15 – Updated: 2026-09-16 16:15

Title

node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)

Summary

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption. This vulnerability is fixed in 2.145.0.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/node-opcua/node-opcua/security…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
node-opcua	node-opcua	Affected: < 2.145.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "node-opcua",
          "vendor": "node-opcua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.145.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption. This vulnerability is fixed in 2.145.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T16:15:58.656Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-cv5q-7543-48q4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-cv5q-7543-48q4"
        }
      ],
      "source": {
        "advisory": "GHSA-cv5q-7543-48q4",
        "discovery": "UNKNOWN"
      },
      "title": "node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-69200",
    "datePublished": "2026-09-16T16:15:58.656Z",
    "dateReserved": "2026-08-03T16:57:50.124Z",
    "dateUpdated": "2026-09-16T16:15:58.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68904 (GCVE-0-2026-68904)

Vulnerability from nvd – Published: 2026-09-16 16:18 – Updated: 2026-09-16 18:34

Title

node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

Summary

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses. ClientSessionKeepAliveManager._ping_server treated the server-originated ServiceFault as a network outage and forced a transport reconnect, while ClientTCP_transport._on_ACK_response used socket.end() after failed HEL/ACK negotiation and could leave the connection in FIN-WAIT-2 when the peer did not close. Repetition at the keepAliveInterval accumulates file descriptors and memory until the client process or container can be terminated by resource exhaustion. This issue is fixed in version 2.170.0.

Severity

7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 18:18 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/node-opcua/node-opcua/security…	x_refsource_CONFIRM
https://github.com/node-opcua/node-opcua/pull/1497	x_refsource_MISC
https://github.com/node-opcua/node-opcua/commit/1…	x_refsource_MISC
https://github.com/node-opcua/node-opcua/commit/4…	x_refsource_MISC
https://github.com/node-opcua/node-opcua/commit/4…	x_refsource_MISC
https://github.com/node-opcua/node-opcua/commit/d…	x_refsource_MISC
https://github.com/node-opcua/node-opcua/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
node-opcua	node-opcua	Affected: >= 2.0.0, < 2.170.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68904",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T18:18:49.358461Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T18:34:50.941Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-opcua",
          "vendor": "node-opcua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.170.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server\u0027s clock skew causes BadInvalidTimestamp responses. ClientSessionKeepAliveManager._ping_server treated the server-originated ServiceFault as a network outage and forced a transport reconnect, while ClientTCP_transport._on_ACK_response used socket.end() after failed HEL/ACK negotiation and could leave the connection in FIN-WAIT-2 when the peer did not close. Repetition at the keepAliveInterval accumulates file descriptors and memory until the client process or container can be terminated by resource exhaustion. This issue is fixed in version 2.170.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T16:18:28.984Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-r2pf-9cw4-5j65",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-r2pf-9cw4-5j65"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/pull/1497",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/pull/1497"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/commit/1959cbb8946b386d2e24a1cce05b7148099d36e7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/commit/1959cbb8946b386d2e24a1cce05b7148099d36e7"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/commit/481664fa6ba8204737c5a92797ff68c3ae780c1c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/commit/481664fa6ba8204737c5a92797ff68c3ae780c1c"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/commit/4d59197e2dbd82791d7f36dad7da178715e0c27a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/commit/4d59197e2dbd82791d7f36dad7da178715e0c27a"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/commit/dc406fd2d364aa69dd173be21ed32a7ff425017a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/commit/dc406fd2d364aa69dd173be21ed32a7ff425017a"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/releases/tag/v2.170.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/releases/tag/v2.170.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r2pf-9cw4-5j65",
        "discovery": "UNKNOWN"
      },
      "title": "node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-68904",
    "datePublished": "2026-09-16T16:18:28.984Z",
    "dateReserved": "2026-07-31T21:04:04.039Z",
    "dateUpdated": "2026-09-16T18:34:50.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54156 (GCVE-0-2026-54156)

Vulnerability from nvd – Published: 2026-09-14 16:09 – Updated: 2026-09-14 16:35

Title

node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

Summary

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create sessions with unique nonces, causing entries to persist after session expiry and accumulate across connection cycles even when maxSessions=10 limits concurrent sessions. The resulting unbounded heap growth can exhaust the default Node.js heap and crash the node-opcua server process. This issue is fixed in version 2.166.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 16:35 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/node-opcua/node-opcua/security…	x_refsource_CONFIRM
https://github.com/node-opcua/node-opcua/commit/b…	x_refsource_MISC
https://github.com/node-opcua/node-opcua/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
node-opcua	node-opcua	Affected: < 2.166.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54156",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T16:35:36.222019Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T16:35:48.958Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-opcua",
          "vendor": "node-opcua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.166.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create sessions with unique nonces, causing entries to persist after session expiry and accumulate across connection cycles even when maxSessions=10 limits concurrent sessions. The resulting unbounded heap growth can exhaust the default Node.js heap and crash the node-opcua server process. This issue is fixed in version 2.166.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T16:09:07.744Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-6wvw-vrw4-363w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-6wvw-vrw4-363w"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/commit/b82c2939fe9c658de58da993f2798ec5481d7313",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/commit/b82c2939fe9c658de58da993f2798ec5481d7313"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/releases/tag/v2.166.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/releases/tag/v2.166.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6wvw-vrw4-363w",
        "discovery": "UNKNOWN"
      },
      "title": "node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54156",
    "datePublished": "2026-09-14T16:09:07.744Z",
    "dateReserved": "2026-06-11T21:15:33.872Z",
    "dateUpdated": "2026-09-14T16:35:48.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54155 (GCVE-0-2026-54155)

Vulnerability from nvd – Published: 2026-09-14 16:07 – Updated: 2026-09-14 16:39

Title

node-opcua: Missing nonce verification in UserNameIdentityToken authentication

Summary

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 16:39 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/node-opcua/node-opcua/security…	x_refsource_CONFIRM
https://github.com/node-opcua/node-opcua/commit/c…	x_refsource_MISC
https://github.com/node-opcua/node-opcua/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
node-opcua	node-opcua	Affected: < 2.166.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54155",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T16:39:00.556555Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T16:39:35.824Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-opcua",
          "vendor": "node-opcua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.166.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T16:07:50.461Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-mq36-523m-x7vv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-mq36-523m-x7vv"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/commit/c6b05738682f5c8d70b1ea275c881f01a1cd9787",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/commit/c6b05738682f5c8d70b1ea275c881f01a1cd9787"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/releases/tag/v2.166.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/releases/tag/v2.166.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mq36-523m-x7vv",
        "discovery": "UNKNOWN"
      },
      "title": "node-opcua: Missing nonce verification in UserNameIdentityToken authentication"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54155",
    "datePublished": "2026-09-14T16:07:50.461Z",
    "dateReserved": "2026-06-11T21:15:33.872Z",
    "dateUpdated": "2026-09-14T16:39:35.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68904 (GCVE-0-2026-68904)

Vulnerability from cvelistv5 – Published: 2026-09-16 16:18 – Updated: 2026-09-16 18:34

Title

node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

Summary

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses. ClientSessionKeepAliveManager._ping_server treated the server-originated ServiceFault as a network outage and forced a transport reconnect, while ClientTCP_transport._on_ACK_response used socket.end() after failed HEL/ACK negotiation and could leave the connection in FIN-WAIT-2 when the peer did not close. Repetition at the keepAliveInterval accumulates file descriptors and memory until the client process or container can be terminated by resource exhaustion. This issue is fixed in version 2.170.0.

Severity

7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 18:18 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/node-opcua/node-opcua/security…	x_refsource_CONFIRM
https://github.com/node-opcua/node-opcua/pull/1497	x_refsource_MISC
https://github.com/node-opcua/node-opcua/commit/1…	x_refsource_MISC
https://github.com/node-opcua/node-opcua/commit/4…	x_refsource_MISC
https://github.com/node-opcua/node-opcua/commit/4…	x_refsource_MISC
https://github.com/node-opcua/node-opcua/commit/d…	x_refsource_MISC
https://github.com/node-opcua/node-opcua/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
node-opcua	node-opcua	Affected: >= 2.0.0, < 2.170.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68904",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T18:18:49.358461Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T18:34:50.941Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-opcua",
          "vendor": "node-opcua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.170.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server\u0027s clock skew causes BadInvalidTimestamp responses. ClientSessionKeepAliveManager._ping_server treated the server-originated ServiceFault as a network outage and forced a transport reconnect, while ClientTCP_transport._on_ACK_response used socket.end() after failed HEL/ACK negotiation and could leave the connection in FIN-WAIT-2 when the peer did not close. Repetition at the keepAliveInterval accumulates file descriptors and memory until the client process or container can be terminated by resource exhaustion. This issue is fixed in version 2.170.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T16:18:28.984Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-r2pf-9cw4-5j65",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-r2pf-9cw4-5j65"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/pull/1497",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/pull/1497"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/commit/1959cbb8946b386d2e24a1cce05b7148099d36e7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/commit/1959cbb8946b386d2e24a1cce05b7148099d36e7"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/commit/481664fa6ba8204737c5a92797ff68c3ae780c1c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/commit/481664fa6ba8204737c5a92797ff68c3ae780c1c"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/commit/4d59197e2dbd82791d7f36dad7da178715e0c27a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/commit/4d59197e2dbd82791d7f36dad7da178715e0c27a"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/commit/dc406fd2d364aa69dd173be21ed32a7ff425017a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/commit/dc406fd2d364aa69dd173be21ed32a7ff425017a"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/releases/tag/v2.170.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/releases/tag/v2.170.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r2pf-9cw4-5j65",
        "discovery": "UNKNOWN"
      },
      "title": "node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-68904",
    "datePublished": "2026-09-16T16:18:28.984Z",
    "dateReserved": "2026-07-31T21:04:04.039Z",
    "dateUpdated": "2026-09-16T18:34:50.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-69200 (GCVE-0-2026-69200)

Vulnerability from cvelistv5 – Published: 2026-09-16 16:15 – Updated: 2026-09-16 16:15

Title

node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)

Summary

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption. This vulnerability is fixed in 2.145.0.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/node-opcua/node-opcua/security…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
node-opcua	node-opcua	Affected: < 2.145.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "node-opcua",
          "vendor": "node-opcua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.145.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption. This vulnerability is fixed in 2.145.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T16:15:58.656Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-cv5q-7543-48q4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-cv5q-7543-48q4"
        }
      ],
      "source": {
        "advisory": "GHSA-cv5q-7543-48q4",
        "discovery": "UNKNOWN"
      },
      "title": "node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-69200",
    "datePublished": "2026-09-16T16:15:58.656Z",
    "dateReserved": "2026-08-03T16:57:50.124Z",
    "dateUpdated": "2026-09-16T16:15:58.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54156 (GCVE-0-2026-54156)

Vulnerability from cvelistv5 – Published: 2026-09-14 16:09 – Updated: 2026-09-14 16:35

Title

node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

Summary

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create sessions with unique nonces, causing entries to persist after session expiry and accumulate across connection cycles even when maxSessions=10 limits concurrent sessions. The resulting unbounded heap growth can exhaust the default Node.js heap and crash the node-opcua server process. This issue is fixed in version 2.166.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 16:35 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/node-opcua/node-opcua/security…	x_refsource_CONFIRM
https://github.com/node-opcua/node-opcua/commit/b…	x_refsource_MISC
https://github.com/node-opcua/node-opcua/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
node-opcua	node-opcua	Affected: < 2.166.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54156",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T16:35:36.222019Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T16:35:48.958Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-opcua",
          "vendor": "node-opcua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.166.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create sessions with unique nonces, causing entries to persist after session expiry and accumulate across connection cycles even when maxSessions=10 limits concurrent sessions. The resulting unbounded heap growth can exhaust the default Node.js heap and crash the node-opcua server process. This issue is fixed in version 2.166.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T16:09:07.744Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-6wvw-vrw4-363w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-6wvw-vrw4-363w"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/commit/b82c2939fe9c658de58da993f2798ec5481d7313",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/commit/b82c2939fe9c658de58da993f2798ec5481d7313"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/releases/tag/v2.166.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/releases/tag/v2.166.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6wvw-vrw4-363w",
        "discovery": "UNKNOWN"
      },
      "title": "node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54156",
    "datePublished": "2026-09-14T16:09:07.744Z",
    "dateReserved": "2026-06-11T21:15:33.872Z",
    "dateUpdated": "2026-09-14T16:35:48.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54155 (GCVE-0-2026-54155)

Vulnerability from cvelistv5 – Published: 2026-09-14 16:07 – Updated: 2026-09-14 16:39

Title

node-opcua: Missing nonce verification in UserNameIdentityToken authentication

Summary

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 16:39 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/node-opcua/node-opcua/security…	x_refsource_CONFIRM
https://github.com/node-opcua/node-opcua/commit/c…	x_refsource_MISC
https://github.com/node-opcua/node-opcua/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
node-opcua	node-opcua	Affected: < 2.166.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54155",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T16:39:00.556555Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T16:39:35.824Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-opcua",
          "vendor": "node-opcua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.166.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T16:07:50.461Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-mq36-523m-x7vv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-mq36-523m-x7vv"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/commit/c6b05738682f5c8d70b1ea275c881f01a1cd9787",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/commit/c6b05738682f5c8d70b1ea275c881f01a1cd9787"
        },
        {
          "name": "https://github.com/node-opcua/node-opcua/releases/tag/v2.166.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/node-opcua/node-opcua/releases/tag/v2.166.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mq36-523m-x7vv",
        "discovery": "UNKNOWN"
      },
      "title": "node-opcua: Missing nonce verification in UserNameIdentityToken authentication"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54155",
    "datePublished": "2026-09-14T16:07:50.461Z",
    "dateReserved": "2026-06-11T21:15:33.872Z",
    "dateUpdated": "2026-09-14T16:39:35.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

8 vulnerabilities by node-opcua

CVE-2026-69200 (GCVE-0-2026-69200)

CVE-2026-68904 (GCVE-0-2026-68904)

CVE-2026-54156 (GCVE-0-2026-54156)

CVE-2026-54155 (GCVE-0-2026-54155)

CVE-2026-68904 (GCVE-0-2026-68904)

CVE-2026-69200 (GCVE-0-2026-69200)

CVE-2026-54156 (GCVE-0-2026-54156)

CVE-2026-54155 (GCVE-0-2026-54155)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

8 vulnerabilities by node-opcua

CVE-2026-69200 (GCVE-0-2026-69200)

CVE-2026-68904 (GCVE-0-2026-68904)

CVE-2026-54156 (GCVE-0-2026-54156)

CVE-2026-54155 (GCVE-0-2026-54155)

CVE-2026-68904 (GCVE-0-2026-68904)

CVE-2026-69200 (GCVE-0-2026-69200)

CVE-2026-54156 (GCVE-0-2026-54156)

CVE-2026-54155 (GCVE-0-2026-54155)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.