Read the docs
TI-2022-05601 Aliases CVE-2022-21208GHSA-4hr4-pjjh-2q2w

Denial of service (DoS) in node-opcua

Priority LOW 36CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.

Why it matters now

EPSS 0.01461 73rd percentileScored 2026-11-07
Fix Fixed node-opcua: 2.74.0node-opcua (npm): 2.74.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—node-opcuabefore 2.74.02.74.0Patch availableCNA
—node-opcua (npm)before 2.74.02.74.0Patch availableGHSA-4hr4-pjjh-2q2w
  • node-opcua Vendor— Affected before 2.74.0 Fixed in 2.74.0 Patch available CNA
  • node-opcua (npm) Vendor— Affected before 2.74.0 Fixed in 2.74.0 Patch available GHSA-4hr4-pjjh-2q2w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:node-opcua_project:node-opcua:*:*:*:*:*:node.js:*:*before 2.74.0VulnerableNode-opcua Project
  • cpe:2.3:a:node-opcua_project:node-opcua:*:*:*:*:*:node.js:*:* Versions before 2.74.0 Vulnerable ·Node-opcua Project

Remediation

  • Fix · CNA node-opcua Fixed in 2.74.0
  • Fix · GHSA-4hr4-pjjh-2q2w node-opcua (npm) Fixed in 2.74.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    node-opcua 2.74.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-08944 Denial of service (DoS) in node-opcuaPriority LOW 36
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-21208
  2. 2026-10-03 Alias added: GHSA-4hr4-pjjh-2q2w

References

Patch 3

Advisory 1

Other 1

  • TI-2022-08944 Denial of service (DoS) in node-opcua CVSS 3.1HIGH 7.5
  • TI-2022-08252 Denial of service (DoS) in node-opcua CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences