CVE-2026-54156 in node-opcua
Summary
by MITRE • 09/14/2026
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create sessions with unique nonces, causing entries to persist after session expiry and accumulate across connection cycles even when maxSessions=10 limits concurrent sessions. The resulting unbounded heap growth can exhaust the default Node.js heap and crash the node-opcua server process. This issue is fixed in version 2.166.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified in node-opcua, a widely used implementation of the OPC UA protocol for TypeScript and Node.js environments, represents a critical resource exhaustion flaw rooted in improper state management within the secure channel layer. Specifically, prior to version 2.166.0, the server component utilized a process-global cache named g_alreadyUsedNonce to track nonces associated with OpenSecureChannelRequest and CreateSession messages via the nonceAlreadyBeenUsed function. This mechanism is designed to prevent replay attacks by ensuring that previously used cryptographic nonces are not reused within valid time windows. However, the implementation failed to enforce any expiration policy or size limits on this cache structure. Consequently, entries for nonces persisted indefinitely in memory long after the associated sessions had expired or been terminated, leading to a gradual but inevitable accumulation of stale data structures over time.
From an operational perspective, this flaw allows an unauthenticated remote attacker to trigger a denial-of-service condition through simple resource exhaustion techniques. By repeatedly initiating new connections and creating sessions with unique nonces, an attacker can force the server to store these entries in the g_alreadyUsedNonce cache without ever cleaning them up. This behavior persists even when configuration parameters such as maxSessions are set to restrictive values like ten, indicating that the limitation applies only to concurrent active sessions rather than historical nonce tracking. As the number of connection cycles increases, the heap memory usage grows unboundedly because each new session adds a permanent entry to the cache regardless of whether it is still relevant for security validation purposes.
The technical impact of this vulnerability is severe due to the constraints inherent in Node.js runtime environments. Since node-opcua operates within the V8 JavaScript engine, which relies on garbage collection and has default heap size limitations depending on the system architecture, unbounded growth directly threatens process stability. Once the allocated memory for the heap is exhausted, the Node.js process will encounter an out-of-memory error and crash abruptly. This results in a complete denial of service for any clients attempting to communicate with the OPC UA server, disrupting industrial automation workflows or monitoring systems that depend on continuous data availability. The lack of authentication requirements further exacerbates the risk, as no credentials are needed to exploit this memory leak, making it accessible to any network actor capable of reaching the exposed endpoint.
This vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, and specifically relates to improper cleanup or expiration of cached data leading to memory leaks. In terms of offensive security frameworks, this flaw can be leveraged within MITRE ATT&CK technique T1499, Endpoint Denial of Service, where the attacker aims to degrade or disrupt services by exhausting system resources rather than compromising confidentiality or integrity directly. The failure to implement a least-privilege approach in memory management allows for sustained disruption without requiring elevated privileges or complex exploitation chains.
To mitigate this vulnerability and restore service stability, organizations running node-opcua must immediately upgrade to version 2.166.0 or later, where the developers have implemented proper expiration policies and size limits for the nonce cache. Until an update can be applied in environments with strict uptime requirements, temporary mitigations may include configuring reverse proxies or firewalls to rate-limit connection attempts from single source IPs, thereby slowing the accumulation of nonces. Additionally, implementing automated monitoring alerts for heap memory usage trends on servers hosting node-opcua instances can provide early warning signs of resource exhaustion before a crash occurs. Regular patch management and adherence to secure coding standards that mandate bounded data structures are essential preventive measures against similar vulnerabilities in network-facing applications.