# CVE-2022-25231: node-opcua denial of service via excessive memory allocation

Source: https://junglewise.ai/threats/cve-2022-25231-node-opcua-denial-of-service-via-excessive-memory-allocation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-25231 · Severity: low · CVSS 3.1 · Published 2022-08-24

node-opcua is a Node.js library that implements the OPC UA industrial protocol, used in manufacturing and control systems to communicate between devices and applications. An attacker can send a specially crafted OPC UA message that causes the application to attempt excessive memory allocation, exhausting the Node.js/v8 engine's memory limit and crashing the service, resulting in availability disruption.

Technologies: [node-opcua (npm)](https://junglewise.ai/threats/technologies/node-opcua). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-25231 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-25231 being exploited in the wild.

**How severe is CVE-2022-25231?** Low severity, with a CVSS score of 3.1, published 24 August 2022.

**Which products and versions are affected?** node-opcua (npm) SEMVER:introduced=0,fixed=2.74.0.

**Is there a fix for CVE-2022-25231?** Yes. node-opcua (npm): upgrade to 2.74.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-25231 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-25231?** Check whether you run node-opcua (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- node-opcua (npm): upgrade to 2.74.0 or later

  ```sh
  npm install node-opcua@2.74.0
  ```


## Technical details

This is a denial-of-service vulnerability caused by improper input validation of OPC UA NodeID fields in incoming messages (CWE-770: Allocation of Resources Without Limits or Throttling). When a specially crafted OPC UA message with a malicious NodeID is received, node-opcua attempts to allocate memory beyond v8's configured limits, causing the process to crash. The vulnerability affects all versions prior to 2.74.0 and requires no authentication—any network-accessible node-opcua instance can be targeted by sending a single malicious message. The fix, merged in August 2022, implements proper service fault handling and input validation to prevent excessive memory allocation.

## Affected products

- node-opcua node-opcua before 2.74.0

## Identifiers

- CVE-2022-25231
- GHSA-qpgc-xh7j-52q8

## Timeline

- 2022-08-24: disclosed: GitHub Security Advisory published
- 2022-08-13: patched: Fix merged into master branch (version 2.74.0)

## References

- [https://github.com/node-opcua/node-opcua/pull/1182](https://github.com/node-opcua/node-opcua/pull/1182)

## Related threats

- [node-opcua namespace-level access control bypass](https://junglewise.ai/threats/cve-2026-95860-node-opcua-is-an-opc-ua-implementation-for-typescript-and-node-js)
- [node-opcua TCP socket leak in keepalive reconnection](https://junglewise.ai/threats/cve-2026-68904-node-opcua-tcp-socket-leak-in-keepalive-reconnection)
- [node-opcua unbounded nonce cache heap exhaustion](https://junglewise.ai/threats/cve-2026-54156-node-opcua-unbounded-nonce-cache-heap-exhaustion)
- [node-opcua missing nonce verification in UserNameIdentityToken authentication](https://junglewise.ai/threats/cve-2026-54155-node-opcua-missing-nonce-verification-in-usernameidentitytoken)
- [node-opcua denial of service via excessive CloseSession requests](https://junglewise.ai/threats/cve-2022-24375-node-opcua-denial-of-service-via-excessive-closesession-requests)