Description
SUMMARY ——- A combination of bugs in node-opcua causes unlimited TCP socket accumulation (FIN-WAIT-2 state) during automatic reconnection, leading to memory exhaustion and eventual container/process crash (OOM kill).
Recommendation
Update the node-opcua package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.0.0, < 2.170.0
- Patched version(s): 2.170.0
References
Could your website be exposed too?
SmartScanner can check your website for node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion and gives you actionable findings to investigate.
Start a free scanRelated Issues
- node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS - CVE-2026-54156
- jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext - jose-node-esm-runtime - CVE-2024-28176
- jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext - jose-node-cjs-runtime - CVE-2024-28176
- node-opcua DoS vulnerability via message with memory allocation that exceeds v8's memory limit - CVE-2022-25231
You might also like:
See something that needs correcting? Let us knowUpdated September 16, 2026