Executive brief
node-opcua-client is a TypeScript/Node.js implementation of the OPC UA industrial communication protocol, commonly used in manufacturing and IoT systems. A prototype pollution flaw in versions before 2.145.0 allows attackers who can control event field data to corrupt the JavaScript object prototype, potentially causing application crashes, logic failures, or denial of service in systems relying on this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the fieldsToJson() method within packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts. The method directly assigns unsanitized field names to objects using output[field] = value syntax, enabling attackers to inject payloads like "__proto__.pollutedKey" to modify Object.prototype. Exploitation requires an application to pass attacker-controlled event field data to fieldsToJson(); no authentication is required. Successful exploitation may cause denial of service, application logic corruption, or potentially arbitrary code execution if polluted keys reach sensitive code paths. The vulnerability is fixed in node-opcua-client 2.145.0.
Affected products
- node-opcua node-opcua-client before 2.145.0
Timeline
- 2026-07-06: disclosed
- 2026-09-16: patched: Version 2.145.0 released