Description

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create sessions with unique nonces, causing entries to persist after session expiry and accumulate across connection cycles even when maxSessions=10 limits concurrent sessions. The resulting unbounded heap growth can exhaust the default Node.js heap and crash the node-opcua server process. This issue is fixed in version 2.166.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T17:17:46.927Z",
  "pubdate": "2026-09-14T17:17:46.927Z",
  "executiveSummary": "A critical memory exhaustion vulnerability exists in node-opcua prior to version 2.166.0, stemming from improper management of nonce validation caches. The flaw resides in the process-global g_alreadyUsedNonce cache, which lacks both size constraints and entry expiration mechanisms.\nAn unauthenticated remote attacker can exploit this by initiating repeated OpenSecureChannelRequest or CreateSession requests, each containing a unique, never-before-seen nonce. Because the server retains these nonces indefinitely, the cache grows monotonically without regard to session lifecycle or concurrent session limits (e.g., maxSessions=10).\nThe successful exploitation of this vulnerability leads to unbounded heap consumption, eventually exceeding the memory limits allocated to the Node.js process. This results in a denial-of-service (DoS) condition, manifesting as a process crash. As the vulnerability is reachable without authentication via the network-exposed OPC UA protocol, it poses a significant threat to the availability and stability of any system leveraging node-opcua for server-side operations.",
  "technicalDetails": "The vulnerability is located within the server secure channel management logic, specifically in 'packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts'. The function 'nonceAlreadyBeenUsed' utilizes a process-global object, 'g_alreadyUsedNonce', to track nonces received during the secure channel handshake process. The intended design of this cache is to mitigate replay attacks; however, the implementation fails to enforce a Time-To-Live (TTL) or a maximum cardinality for the stored entries.\nIn a standard implementation, nonce storage should be ephemeral, ideally tied to the lifespan of the secure channel or session object. By contrast, the 'g_alreadyUsedNonce' implementation functions as an ever-growing memory leak. Because these nonces are never purged after the associated secure channel is closed or the session expires, the heap usage increases linearly with every new connection attempt.\nThe attack flow proceeds as follows: First, the attacker identifies a target node-opcua server exposing an OPC UA endpoint. Second, the attacker initiates a series of 'OpenSecureChannelRequest' or 'CreateSession' requests. Each request is crafted to include a unique, cryptographically distinct nonce. Third, the server processes these requests and invokes 'nonceAlreadyBeenUsed' to validate the nonce, resulting in the new nonce being appended to the 'g_alreadyUsedNonce' collection. Fourth, the attacker repeats this process at a high frequency. Despite the server's 'maxSessions=10' configuration, which limits concurrent active sessions, the 'g_alreadyUsedNonce' cache persists independently of session state. Consequently, the attacker does not need to maintain open sessions to facilitate the memory exhaustion.\nEventually, the accumulated size of the cache objects exhausts the memory allocated to the Node.js heap. Once the heap limit is reached, the V8 engine triggers an out-of-memory error, causing the node-opcua server process to crash. This attack requires no prior authentication and can be executed over any network path capable of reaching the OPC UA service. The impact is a persistent Denial of Service that requires a manual restart of the server process, providing a trivial vector for resource exhaustion attacks."
}