# CVE-2022-21208: node-opcua denial of service via message chunks

Source: https://junglewise.ai/threats/cve-2022-21208-node-opcua-denial-of-service-via-message-chunks  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-21208 · Severity: low · CVSS 3.1 · Published 2022-08-24

node-opcua is a JavaScript implementation of the OPC UA industrial automation protocol stack. A flaw in how the library assembles incoming message chunks allows an attacker to send unlimited large chunks (e.g., 2GB each) without completing the transmission, causing the server to exhaust memory and crash. This can render OPC UA-dependent industrial systems and SCADA applications unavailable.

Technologies: [node-opcua (npm)](https://junglewise.ai/threats/technologies/node-opcua). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-21208 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-21208 being exploited in the wild.

**How severe is CVE-2022-21208?** Low severity, with a CVSS score of 3.1, published 24 August 2022.

**Which products and versions are affected?** node-opcua (npm) SEMVER:introduced=0,fixed=2.74.0.

**Is there a fix for CVE-2022-21208?** Yes. node-opcua (npm): upgrade to 2.74.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-21208 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-21208?** Check whether you run node-opcua (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- node-opcua (npm): upgrade to 2.74.0 or later

  ```sh
  npm install node-opcua@2.74.0
  ```


## Technical details

The vulnerability is a resource exhaustion flaw (CWE-400) in the packet assembler component of node-opcua. The vulnerability stems from missing validation and limits on the number of received message chunks, both per-session and globally across concurrent sessions. An attacker can exploit this by sending a stream of large incomplete OPC UA message chunks to a vulnerable server without ever sending the required "final" chunk marker. This causes the server to accumulate unbounded amounts of memory as it buffers these chunks, leading to memory exhaustion and denial of service. The attack is network-based and requires no authentication or user interaction. The fix, introduced in version 2.74.0, adds chunk size verification and enforces limits on accumulated chunk data.

## Affected products

- node-opcua node-opcua < 2.74.0

## Identifiers

- CVE-2022-21208
- GHSA-4hr4-pjjh-2q2w

## Timeline

- 2022-08-23: disclosed: CVE-2022-21208 disclosed
- 2022-08-24: advisory: GHSA-4hr4-pjjh-2q2w published
- 2022-06-02: patched: Patches merged in PR #1149 and commits addressing message chunk overflow detection

## References

- [https://github.com/node-opcua/node-opcua/pull/1149](https://github.com/node-opcua/node-opcua/pull/1149)
- [https://github.com/node-opcua/node-opcua/commit/33ca3bab4ab781392a2f8d8f5a14de9a0aa0e410](https://github.com/node-opcua/node-opcua/commit/33ca3bab4ab781392a2f8d8f5a14de9a0aa0e410)
- [https://github.com/node-opcua/node-opcua/commit/dbcb5d5191118c22ee9c89332a94b94e6553d76b](https://github.com/node-opcua/node-opcua/commit/dbcb5d5191118c22ee9c89332a94b94e6553d76b)
- [https://github.com/node-opcua/node-opcua](https://github.com/node-opcua/node-opcua)
- [https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988723](https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988723)

## Related threats

- [node-opcua namespace-level access control bypass](https://junglewise.ai/threats/cve-2026-95860-node-opcua-is-an-opc-ua-implementation-for-typescript-and-node-js)
- [node-opcua TCP socket leak in keepalive reconnection](https://junglewise.ai/threats/cve-2026-68904-node-opcua-tcp-socket-leak-in-keepalive-reconnection)
- [node-opcua unbounded nonce cache heap exhaustion](https://junglewise.ai/threats/cve-2026-54156-node-opcua-unbounded-nonce-cache-heap-exhaustion)
- [node-opcua missing nonce verification in UserNameIdentityToken authentication](https://junglewise.ai/threats/cve-2026-54155-node-opcua-missing-nonce-verification-in-usernameidentitytoken)
- [node-opcua denial of service via excessive CloseSession requests](https://junglewise.ai/threats/cve-2022-24375-node-opcua-denial-of-service-via-excessive-closesession-requests)