node-opcua

Records5All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

node-opcua records in CISA KEV

No node-opcua vulnerabilities are listed in CISA KEV.

Records

5 records

TI-2026-84561 CVE-2026-95860

Authorization bypass in node-opcua lets anonymous clients write

HIGH 80

node-opcua is an OPC UA implementation for TypeScript and Node.js.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00596 Published 2026-11-03 Fixed in 2.180.0 CWE-1188

TI-2026-48544 CVE-2026-69200

node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)

MEDIUM 51

node-opcua is an OPC UA implementation for TypeScript and Node.js.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00346 Published 2026-09-16 Fixed in 2.145.0 CWE-1321

TI-2026-39066 CVE-2026-54156 · GHSA-6wvw-vrw4-363w

node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

MEDIUM 40

node-opcua is an OPC UA implementation for TypeScript and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00784 Published 2026-09-14 Fixed in 2.166.0 CWE-770

TI-2026-39065 CVE-2026-54155 · GHSA-mq36-523m-x7vv

node-opcua: Missing nonce verification in UserNameIdentityToken authentication

LOW 36

node-opcua is an OPC UA implementation for TypeScript and Node.js.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00424 Published 2026-09-14 Fixed in 2.166.0 CWE-347

TI-2026-48457 CVE-2026-68904 · GHSA-r2pf-9cw4-5j65

node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

LOW 31

node-opcua is an OPC UA implementation for TypeScript and Node.js.

CVSS 3.1HIGH 7.0 Network No auth No interaction EPSS 0.00443 Published 2026-09-16 Fixed in 2.170.0 CWE-400

Open these records in search →