Description
Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash.
Affected versions: <= 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 (High) CVSS Vector: CVSS:3.
Recommendation
Update the node-opcua package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.166.0
- Patched version(s): 2.166.0
References
Could your website be exposed too?
SmartScanner can check your website for node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion - CVE-2026-68904
- ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS - CVE-2026-113656
- node-opcua missing nonce verification in UserNameIdentityToken authentication - CVE-2026-54155
- Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) - CVE-2026-116581
You might also like:
See something that needs correcting? Let us knowUpdated August 27, 2026