CVE-2026-69200

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarmsandconditions/clientalarm.ts directly assigns unsanitized field names and allows a proto.pollutedKey path to modify...

CVE-2026-68904

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses...

GHSA-R2PF-9CW4-5J65 node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

SUMMARY ------- A combination of bugs in node-opcua causes unlimited TCP socket accumulation FIN-WAIT-2 state during automatic reconnection, leading to memory exhaustion and eventual container/process crash OOM kill. The issue is triggered by the default configuration keepSessionAlive: true when...

node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

SUMMARY ------- A combination of bugs in node-opcua causes unlimited TCP socket accumulation FIN-WAIT-2 state during automatic reconnection, leading to memory exhaustion and eventual container/process crash OOM kill. The issue is triggered by the default configuration keepSessionAlive: true when...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +41 more potentially affected by CVE-2026-68904 via node-opcua (>=2.10.0, <=2.169.0)

node-opcua NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.197, =1.3.6-alpha.36, =1.3.5, =1.4.15-alpha.279, =1.4.15-alpha.279, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =1.3.6-alpha.36 and more Source cves: CVE-2026-68904 Source advisory:...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +52 more potentially affected by CVE-2026-68904 via node-opcua-transport (>=2.10.0, <=2.169.0)

node-opcua-transport NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.197, =1.3.6-alpha.36, =1.3.5, =1.4.15-alpha.279, =1.4.15-alpha.279, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =1.3.6-alpha.36 and more Source cves: CVE-2026-68904 Source advisory:...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +52 more potentially affected by CVE-2026-68904 via node-opcua-transport (>=2.10.0, <=2.169.0)

node-opcua-transport NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.197, =1.3.6-alpha.36, =1.3.5, =1.4.15-alpha.279, =1.4.15-alpha.279, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =1.3.6-alpha.36 and more Source cves: CVE-2026-68904 Source advisory:...

NPM: node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

Resource Exhaustion vulnerability discovered by ? in WordPress Npm node-opcua versions = 2.0.0, 2.170.0...

NPM: node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

Resource Exhaustion vulnerability discovered by ? in WordPress Npm node-opcua-client versions = 2.0.0, 2.170.0...

NPM: node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

Resource Exhaustion vulnerability discovered by ? in WordPress Npm node-opcua-transport versions = 2.0.0, 2.170.0...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +50 more potentially affected by CVE-2026-68904 via node-opcua-client (>=2.10.0, <=2.169.0)

node-opcua-client NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.197, =1.3.6-alpha.36, =1.3.5, =1.4.15-alpha.279, =1.4.15-alpha.279, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =1.3.6-alpha.36 and more Source cves: CVE-2026-68904 Source advisory:...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +50 more potentially affected by CVE-2026-68904 via node-opcua-client (>=2.10.0, <=2.169.0)

node-opcua-client NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.197, =1.3.6-alpha.36, =1.3.5, =1.4.15-alpha.279, =1.4.15-alpha.279, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =1.3.6-alpha.36 and more Source cves: CVE-2026-68904 Source advisory:...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +41 more potentially affected by CVE-2026-68904 via node-opcua (>=2.10.0, <=2.169.0)

node-opcua NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.197, =1.3.6-alpha.36, =1.3.5, =1.4.15-alpha.279, =1.4.15-alpha.279, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =1.3.6-alpha.36 and more Source cves: CVE-2026-68904 Source advisory:...

CVE-2026-68904 node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses...

EUVD-2026-80869

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses...

CVE-2026-68904

node-opcua (an OPC UA implementation for TypeScript/Node.js) versions 2.0.0 through 2.170.0 are affected by a TCP socket leak caused by a keepalive reconnection cycle. When an OPC UA server's clock skew produces BadInvalidTimestamp responses, ClientSessionKeepAliveManager._ping_server misclassifi...

CVE-2026-68904 node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses...

CVE-2026-68904 node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses...

CVE-2026-68904

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +50 more potentially affected by CVE-2026-68904 via node-opcua-client (>=2.10.0, <=2.169.0)

node-opcua-client NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.197, =1.3.6-alpha.36, =1.3.5, =1.4.15-alpha.279, =1.4.15-alpha.279, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =1.3.6-alpha.36 and more Source cves: CVE-2026-68904 Source advisory:...