Executive brief
node-opcua is a Node.js library for connecting to OPC UA industrial automation servers. A resource exhaustion vulnerability allows TCP sockets to accumulate in FIN-WAIT-2 state during automatic reconnection cycles, causing memory exhaustion and process crashes. The issue is triggered by default settings when the remote server has clock skew relative to the client.
Technical details
The vulnerability combines two bugs in node-opcua. First, ClientTCP_transport._on_ACK_response() calls socket.end() instead of socket.destroy() on failed handshakes, leaving sockets in FIN-WAIT-2 state if the peer doesn't respond (common with PLCs). Second, ClientSessionKeepAliveManager._ping_server() incorrectly treats BadInvalidTimestamp responses (application-level OPC UA status codes caused by clock skew) as fatal network errors, triggering reconnection on every keepalive ping. With default keepAliveInterval of 3 seconds, this causes ~20 socket leaks per minute. No special privileges or user interaction required; the vulnerability is triggered by default configuration (keepSessionAlive: true) when connecting to a server with clock skew. Fixed in version 2.170.0.
Affected products
- node-opcua node-opcua 2.0.0 to 2.169.0
- node-opcua node-opcua-client 2.0.0 to 2.169.0
- node-opcua node-opcua-transport 2.0.0 to 2.169.0
Timeline
- 2026-09-16: disclosed: Advisory GHSA-r2pf-9cw4-5j65 published
- 2026-09-16: patched: Version 2.170.0 released with fixes