Is CVE-2026-54156 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54156 being exploited in the wild.

How severe is CVE-2026-54156?

High severity, with a CVSS score of 7.5, published 14 September 2026.

Which products and versions are affected?

node-opcua (npm) < 2.166.0, SEMVER:introduced=0,fixed=2.166.0.

Is there a fix for CVE-2026-54156?

Yes. node-opcua (npm): upgrade to 2.166.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54156 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54156?

Check whether you run node-opcua (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54156: node-opcua unbounded nonce cache heap exhaustion

Q: Which products and versions are affected?

node-opcua (npm) < 2.166.0, SEMVER:introduced=0,fixed=2.166.0.

Q: Is there a fix for CVE-2026-54156?

Yes. node-opcua (npm): upgrade to 2.166.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54156 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54156?

Check whether you run node-opcua (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54156 · Severity: high · CVSS 7.5 · Published 2026-09-14

node-opcua is a Node.js implementation of the OPC UA (OLE for Process Control Unified Architecture) protocol, used to enable industrial automation and IoT device communication. An unauthenticated remote attacker can repeatedly send session creation requests that force the server to cache nonce values indefinitely, causing the server process to consume all available memory and crash, resulting in denial of service for all connected clients and applications relying on that OPC UA server.

Technologies: node-opcua (npm). Vendors: npm.

Quick answers

Is CVE-2026-54156 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54156 being exploited in the wild.
How severe is CVE-2026-54156?: High severity, with a CVSS score of 7.5, published 14 September 2026.
Which products and versions are affected?: node-opcua (npm) < 2.166.0, SEMVER:introduced=0,fixed=2.166.0.
Is there a fix for CVE-2026-54156?: Yes. node-opcua (npm): upgrade to 2.166.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54156 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54156?: Check whether you run node-opcua (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-opcua (npm): upgrade to 2.166.0 or later
```
npm install node-opcua@2.166.0
```

Technical details

The vulnerability is a resource exhaustion flaw (CWE-770) located in `packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts` at line 156. The `g_alreadyUsedNonce` object is a process-global cache used for replay attack detection; nonces are inserted on every `OpenSecureChannelRequest` and `CreateSession` request but are never evicted or expired. An attacker can exploit the unauthenticated `CreateSession` path (which does not require a certificate) to accumulate arbitrary nonce entries. Even though concurrent session limits (e.g., `maxSessions=10`) restrict active sessions, expired nonces remain in memory indefinitely, allowing an attacker to gradually exhaust heap across repeated connection cycles. Testing confirmed that 5,000 unique nonces consume ~1.23 MB resident heap, and projections suggest 1 million nonces would consume ~246 MB—enough to trigger out-of-memory conditions on default Node.js heap limits. The fix involves implementing a TTL-based eviction policy using timestamp entries and periodic cleanup.

Affected products

node-opcua node-opcua < 2.166.0

Identifiers

CVE-2026-54156
GHSA-6wvw-vrw4-363w

Timeline

2026-03-23: disclosed: Vulnerability discovery date
2026-08-20: advisory: Published to GitHub Advisory Database
2026-07-03: patched: Fix released in version 2.166.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.