Executive brief
node-opcua is a Node.js implementation of the OPC UA (OLE for Process Control Unified Architecture) protocol, used to enable industrial automation and IoT device communication. An unauthenticated remote attacker can repeatedly send session creation requests that force the server to cache nonce values indefinitely, causing the server process to consume all available memory and crash, resulting in denial of service for all connected clients and applications relying on that OPC UA server.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-770) located in `packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts` at line 156. The `g_alreadyUsedNonce` object is a process-global cache used for replay attack detection; nonces are inserted on every `OpenSecureChannelRequest` and `CreateSession` request but are never evicted or expired. An attacker can exploit the unauthenticated `CreateSession` path (which does not require a certificate) to accumulate arbitrary nonce entries. Even though concurrent session limits (e.g., `maxSessions=10`) restrict active sessions, expired nonces remain in memory indefinitely, allowing an attacker to gradually exhaust heap across repeated connection cycles. Testing confirmed that 5,000 unique nonces consume ~1.23 MB resident heap, and projections suggest 1 million nonces would consume ~246 MB—enough to trigger out-of-memory conditions on default Node.js heap limits. The fix involves implementing a TTL-based eviction policy using timestamp entries and periodic cleanup.
Affected products
- node-opcua node-opcua < 2.166.0
Timeline
- 2026-03-23: disclosed: Vulnerability discovery date
- 2026-08-20: advisory: Published to GitHub Advisory Database
- 2026-07-03: patched: Fix released in version 2.166.0