{"id":"CVE-2026-54156","aliases":["EUVD-2026-77624","GHSA-6wvw-vrw4-363w"],"status":"published","title":"node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS","description":"node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create sessions with unique nonces, causing entries to persist after session expiry and accumulate across connection cycles even when maxSessions=10 limits concurrent sessions. The resulting unbounded heap growth can exhaust the default Node.js heap and crash the node-opcua server process. This issue is fixed in version 2.166.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00784,"percentile":0.56542,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-08-20T18:35:41Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"npm","package":"node-opcua","fixed_in":["2.166.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"node-opcua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.166.0"}]}]},{"source":"osv","ecosystem":"npm","package":"node-opcua","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.166.0"}]}]}],"products":[{"vendor":"node-opcua","product":"node-opcua"}],"references":[{"url":"https://github.com/node-opcua/node-opcua/security/advisories/GHSA-6wvw-vrw4-363w","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/node-opcua/node-opcua/commit/b82c2939fe9c658de58da993f2798ec5481d7313","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/node-opcua/node-opcua/releases/tag/v2.166.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-6wvw-vrw4-363w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54156.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54156","tags":["advisory"]},{"url":"https://github.com/node-opcua/node-opcua","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54156","title":"node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS","description":"node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create sessions with unique nonces, causing entries to persist after session expiry and accumulate across connection cycles even when maxSessions=10 limits concurrent sessions. The resulting unbounded heap growth can exhaust the default Node.js heap and crash the node-opcua server process. This issue is fixed in version 2.166.0.","status":"published","published":"2026-09-14T16:09:07.744Z","modified":"2026-09-14T16:35:48.958Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-77624","description":"node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create sessions with unique nonces, causing entries to persist after session expiry and accumulate across connection cycles even when maxSessions=10 limits concurrent sessions. The resulting unbounded heap growth can exhaust the default Node.js heap and crash the node-opcua server process. This issue is fixed in version 2.166.0.","status":"published","published":"2026-09-14T16:09:07Z","modified":"2026-09-14T16:35:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:20.0825Z"}],"ghsa":[{"id":"GHSA-6wvw-vrw4-363w","title":"node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS","description":"**Summary**\nA process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash.\n\n**Affected versions:** \u003c= 2.165.0\n**Tested version:** 2.165.0\n**CVSS Score:** 7.5 (High)\n**CVSS Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n**CWE:** CWE-770 Allocation of Resources Without Limits or Throttling\n\n---\n\n**Root Cause**\n\nIn `packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts` at line 156, `g_alreadyUsedNonce` is a process-global object used to track previously seen nonces for replay detection. Entries are added on every `OpenSecureChannelRequest` and every `CreateSession` request but are never removed or expired.\n\nAn unauthenticated attacker can exploit the `CreateSession` path (which requires no certificate) to accumulate nonce entries indefinitely. Even with `maxSessions=10` limiting concurrent sessions, nonces persist after session expiry, allowing slow but reliable heap exhaustion across repeated connection cycles.\n\n---\n\n**Measured Impact**\n\nDynamically confirmed heap growth:\n- 5,000 unique nonces → +1.23 MB resident heap, no eviction after explicit GC\n- Projected: 10^6 nonces → ~246 MB resident heap\n- Achievable OOM on default Node.js heap limits\n\n---\n\n**Suggested Fix**\n\nAdd a TTL-based eviction policy to `g_alreadyUsedNonce`. Nonces should be expired after the maximum session timeout (or a reasonable fixed window, e.g. 1 hour). A Map with timestamp entries and periodic cleanup is sufficient.\n\n---\n\nI am following a 90-day responsible disclosure policy. I am happy to provide additional technical details under embargo. Please confirm receipt at your earliest convenience.\n\nReporter: Stanley Tobias\nDiscovery date: 2026-03-23","status":"published","published":"2026-08-20T18:35:41Z","modified":"2026-08-27T19:04:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:41:07.031507Z"}],"nvd":[{"id":"CVE-2026-54156","description":"node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create sessions with unique nonces, causing entries to persist after session expiry and accumulate across connection cycles even when maxSessions=10 limits concurrent sessions. The resulting unbounded heap growth can exhaust the default Node.js heap and crash the node-opcua server process. This issue is fixed in version 2.166.0.","status":"published","published":"2026-09-14T17:17:46.927Z","modified":"2026-09-30T19:38:27.293Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:46.980627Z"}],"osv":[{"id":"CVE-2026-54156","title":"node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS","description":"node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create sessions with unique nonces, causing entries to persist after session expiry and accumulate across connection cycles even when maxSessions=10 limits concurrent sessions. The resulting unbounded heap growth can exhaust the default Node.js heap and crash the node-opcua server process. This issue is fixed in version 2.166.0.","status":"published","published":"2026-09-14T16:09:07.744Z","modified":"2026-10-28T02:30:59.06366108Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"GHSA-6wvw-vrw4-363w","title":"node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS","description":"**Summary**\nA process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash.\n\n**Affected versions:** \u003c= 2.165.0\n**Tested version:** 2.165.0\n**CVSS Score:** 7.5 (High)\n**CVSS Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n**CWE:** CWE-770 Allocation of Resources Without Limits or Throttling\n\n---\n\n**Root Cause**\n\nIn `packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts` at line 156, `g_alreadyUsedNonce` is a process-global object used to track previously seen nonces for replay detection. Entries are added on every `OpenSecureChannelRequest` and every `CreateSession` request but are never removed or expired.\n\nAn unauthenticated attacker can exploit the `CreateSession` path (which requires no certificate) to accumulate nonce entries indefinitely. Even with `maxSessions=10` limiting concurrent sessions, nonces persist after session expiry, allowing slow but reliable heap exhaustion across repeated connection cycles.\n\n---\n\n**Measured Impact**\n\nDynamically confirmed heap growth:\n- 5,000 unique nonces → +1.23 MB resident heap, no eviction after explicit GC\n- Projected: 10^6 nonces → ~246 MB resident heap\n- Achievable OOM on default Node.js heap limits\n\n---\n\n**Suggested Fix**\n\nAdd a TTL-based eviction policy to `g_alreadyUsedNonce`. Nonces should be expired after the maximum session timeout (or a reasonable fixed window, e.g. 1 hour). A Map with timestamp entries and periodic cleanup is sufficient.\n\n---\n\nI am following a 90-day responsible disclosure policy. I am happy to provide additional technical details under embargo. Please confirm receipt at your earliest convenience.\n\nReporter: Stanley Tobias\nDiscovery date: 2026-03-23","status":"published","published":"2026-08-20T18:35:41Z","modified":"2026-08-27T19:15:07.090081514Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:40.308826Z"}]}}