# CVE-2026-95860: node-opcua namespace-level access control bypass

Source: https://junglewise.ai/threats/cve-2026-95860-node-opcua-is-an-opc-ua-implementation-for-typescript-and-node-js  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-95860 · Severity: critical · CVSS 9.1 · Published 2026-11-03

node-opcua is an OPC UA server implementation for TypeScript and Node.js, used to expose industrial control systems and data to networked clients. A flaw in versions 2.42.0 through 2.179.x causes namespace-level access control policies configured by operators to be silently ignored, allowing anonymous network clients to write variables or execute methods that should be restricted. Servers relying on namespace-wide permission defaults instead of per-node rules are at risk of unauthorized control or data modification.

Technologies: [node-opcua (npm)](https://junglewise.ai/threats/technologies/node-opcua). Vendors: [Node-Opcua](https://junglewise.ai/threats/vendors/node-opcua), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-95860 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95860 being exploited in the wild.

**How severe is CVE-2026-95860?** Critical severity, with a CVSS score of 9.1, published 3 November 2026.

**Which products and versions are affected?** Node-Opcua 2.42.0 through 2.179.x; node-opcua (npm) >= 2.42.0, < 2.180.0, SEMVER:introduced=2.42.0,fixed=2.180.0; node-opcua-address-space (npm) >= 2.42.0, < 2.180.0, SEMVER:introduced=2.42.0,fixed=2.180.0; node-opcua-server (npm) >= 2.42.0, < 2.180.0, SEMVER:introduced=2.42.0,fixed=2.180.0.

**Is there a fix for CVE-2026-95860?** Yes. node-opcua (npm): upgrade to 2.180.0 or later; node-opcua-address-space (npm): upgrade to 2.180.0 or later; node-opcua-server (npm): upgrade to 2.180.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95860 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-95860?** Check whether you run Node-Opcua, node-opcua (npm), node-opcua-address-space (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- node-opcua (npm): upgrade to 2.180.0 or later

  ```sh
  npm install node-opcua@2.180.0
  ```

- node-opcua-address-space (npm): upgrade to 2.180.0 or later

  ```sh
  npm install node-opcua-address-space@2.180.0
  ```

- node-opcua-server (npm): upgrade to 2.180.0 or later

  ```sh
  npm install node-opcua-server@2.180.0
  ```


## Technical details

The vulnerability stems from a mismatch in where namespace default role permissions are stored versus where they are read during enforcement. The setDefaultRolePermissions() API writes to a namespace field, but SessionContext.getApplicableRolePermissions() reads from the DefaultRolePermissions metadata node instead; when that metadata node is absent or null, the check treats the result permissively rather than falling back to the configured namespace default. An unauthenticated network client can exploit this to bypass intended write and method-call restrictions on nodes without explicit per-node permissions.

## Affected products

- node-opcua node-opcua 2.42.0 through 2.179.x

## Identifiers

- CVE-2026-95860
- GHSA-xggf-m53x-jc3f

## Timeline

- 2026-08-28: patched: Fix committed and merged to master
- 2026-11-03: disclosed

## References

- [https://github.com/node-opcua/node-opcua/commit/0261e873900800983c622e01120f484dc6063698](https://github.com/node-opcua/node-opcua/commit/0261e873900800983c622e01120f484dc6063698)
- [https://github.com/node-opcua/node-opcua/pull/1580](https://github.com/node-opcua/node-opcua/pull/1580)

## Related threats

- [node-opcua TCP socket leak in keepalive reconnection](https://junglewise.ai/threats/cve-2026-68904-node-opcua-tcp-socket-leak-in-keepalive-reconnection)
- [node-opcua unbounded nonce cache heap exhaustion](https://junglewise.ai/threats/cve-2026-54156-node-opcua-unbounded-nonce-cache-heap-exhaustion)
- [node-opcua missing nonce verification in UserNameIdentityToken authentication](https://junglewise.ai/threats/cve-2026-54155-node-opcua-missing-nonce-verification-in-usernameidentitytoken)
- [node-opcua denial of service via excessive CloseSession requests](https://junglewise.ai/threats/cve-2022-24375-node-opcua-denial-of-service-via-excessive-closesession-requests)
- [node-opcua denial of service via message chunks](https://junglewise.ai/threats/cve-2022-21208-node-opcua-denial-of-service-via-message-chunks)