Is CVE-2022-25231 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-25231 being exploited in the wild.

How severe is CVE-2022-25231?

Low severity, with a CVSS score of 3.1, published 24 August 2022.

Which products and versions are affected?

node-opcua (npm) SEMVER:introduced=0,fixed=2.74.0.

Is there a fix for CVE-2022-25231?

Yes. node-opcua (npm): upgrade to 2.74.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-25231 attacked?

It is attacked over the network.

Am I affected by CVE-2022-25231?

Check whether you run node-opcua (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-25231: node-opcua denial of service via excessive memory allocation

CVE-2022-25231 · Severity: low · CVSS 3.1 · Published 2022-08-24

node-opcua is a Node.js library that implements the OPC UA industrial protocol, used in manufacturing and control systems to communicate between devices and applications. An attacker can send a specially crafted OPC UA message that causes the application to attempt excessive memory allocation, exhausting the Node.js/v8 engine's memory limit and crashing the service, resulting in availability disruption.

Technologies: node-opcua (npm). Vendors: npm.

Quick answers

Is CVE-2022-25231 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-25231 being exploited in the wild.
How severe is CVE-2022-25231?: Low severity, with a CVSS score of 3.1, published 24 August 2022.
Which products and versions are affected?: node-opcua (npm) SEMVER:introduced=0,fixed=2.74.0.
Is there a fix for CVE-2022-25231?: Yes. node-opcua (npm): upgrade to 2.74.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-25231 attacked?: It is attacked over the network.
Am I affected by CVE-2022-25231?: Check whether you run node-opcua (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-opcua (npm): upgrade to 2.74.0 or later
```
npm install node-opcua@2.74.0
```

Technical details

This is a denial-of-service vulnerability caused by improper input validation of OPC UA NodeID fields in incoming messages (CWE-770: Allocation of Resources Without Limits or Throttling). When a specially crafted OPC UA message with a malicious NodeID is received, node-opcua attempts to allocate memory beyond v8's configured limits, causing the process to crash. The vulnerability affects all versions prior to 2.74.0 and requires no authentication—any network-accessible node-opcua instance can be targeted by sending a single malicious message. The fix, merged in August 2022, implements proper service fault handling and input validation to prevent excessive memory allocation.

Affected products

node-opcua node-opcua before 2.74.0

Identifiers

CVE-2022-25231
GHSA-qpgc-xh7j-52q8

Timeline

2022-08-24: disclosed: GitHub Security Advisory published
2022-08-13: patched: Fix merged into master branch (version 2.74.0)

References

https://github.com/node-opcua/node-opcua/pull/1182

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.