Node-opcua vulnerabilities
We track 7 vulnerabilities in Node-opcua products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest Node-opcua vulnerabilities
- 9.1 Critical severity
node-opcua: Improper Authorization
node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePer
- 7.0 High severity
node-opcua: Uncontrolled Resource Consumption
node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp res
- 7.5 High severity
node-opcua: Allocation of Resources Without Limits or Throttling
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from
- 7.7 High severity
node-opcua: Improper Verification of Cryptographic Signature
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing
- 7.5 High severity
node-opcua: Uncontrolled Resource Consumption
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
- 7.5 High severity
node-opcua: Allocation of Resources Without Limits or Throttling
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit.
- 7.5 High severity
node-opcua: Improper Validation of Specified Quantity in Input
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an u