Executive brief
node-opcua is a Node.js library that implements the OPC UA industrial protocol, used in manufacturing and control systems to communicate between devices and applications. An attacker can send a specially crafted OPC UA message that causes the application to attempt excessive memory allocation, exhausting the Node.js/v8 engine's memory limit and crashing the service, resulting in availability disruption.
Technical details
This is a denial-of-service vulnerability caused by improper input validation of OPC UA NodeID fields in incoming messages (CWE-770: Allocation of Resources Without Limits or Throttling). When a specially crafted OPC UA message with a malicious NodeID is received, node-opcua attempts to allocate memory beyond v8's configured limits, causing the process to crash. The vulnerability affects all versions prior to 2.74.0 and requires no authentication—any network-accessible node-opcua instance can be targeted by sending a single malicious message. The fix, merged in August 2022, implements proper service fault handling and input validation to prevent excessive memory allocation.
Affected products
- node-opcua node-opcua before 2.74.0
Timeline
- 2022-08-24: disclosed: GitHub Security Advisory published
- 2022-08-13: patched: Fix merged into master branch (version 2.74.0)