{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/node-opcua/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["node-opcua"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe node-opcua library, specifically versions 2.165.0 and earlier, contains a critical vulnerability (CVE-2026-54156) in its secure channel layer. The library maintains a process-global object, \u003ccode\u003eg_alreadyUsedNonce\u003c/code\u003e, to track nonces for replay detection. This cache lacks an eviction policy, causing it to grow indefinitely as it records every \u003ccode\u003eOpenSecureChannelRequest\u003c/code\u003e and \u003ccode\u003eCreateSession\u003c/code\u003e request processed by the server.\u003c/p\u003e\n\u003cp\u003eAn unauthenticated remote attacker can exploit this by repeatedly initiating \u003ccode\u003eCreateSession\u003c/code\u003e requests, which do not require prior authentication or valid certificates. Because these nonce entries persist even after session expiry, the server's heap memory usage grows linearly with the number of requests until the Node.js process reaches its heap limit and crashes. This vulnerability represents a significant Denial of Service (DoS) risk for industrial systems utilizing node-opcua for OPC UA communications.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to a Denial of Service (DoS) of the node-opcua server process. Empirical testing indicates that 5,000 unique nonces increase resident heap usage by approximately 1.23 MB. Extrapolating this growth to 1,000,000 requests results in a memory footprint increase of approximately 246 MB, which is sufficient to exhaust default Node.js heap limits in many operational environments, forcing a process crash and service interruption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a patched version of node-opcua that implements a TTL-based eviction policy for the nonce cache.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, implement rate-limiting at the network layer for \u003ccode\u003eCreateSession\u003c/code\u003e and \u003ccode\u003eOpenSecureChannel\u003c/code\u003e requests to slow the rate of cache growth.\u003c/li\u003e\n\u003cli\u003eDeploy monitoring for node-opcua memory utilization; alerts should be configured to trigger on anomalous heap growth or rapidly increasing memory consumption by the application process.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-20T19:14:13Z","date_published":"2026-08-20T19:14:13Z","id":"https://feed.craftedsignal.io/briefs/2026-08-node-opcua-heap-exhaustion/","summary":"An unbounded nonce cache in the node-opcua library allows unauthenticated remote attackers to trigger heap memory exhaustion and process crashes via repeated session creation requests.","title":"Unauthenticated Heap Exhaustion DoS in node-opcua","url":"https://feed.craftedsignal.io/briefs/2026-08-node-opcua-heap-exhaustion/"}],"language":"en","title":"CraftedSignal Threat Feed - Node-Opcua","version":"https://jsonfeed.org/version/1.1"}