CVE-2026-68904

node-opcua (an OPC UA implementation for TypeScript/Node.js) versions 2.0.0 through 2.170.0 are affected by a TCP socket leak caused by a keepalive reconnection cycle. When an OPC UA server's clock skew produces BadInvalidTimestamp responses, ClientSessionKeepAliveManager._ping_server misclassifi...

CVE-2026-68904 node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses...