NPM: node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

Resource Exhaustion vulnerability discovered by ? in WordPress Npm node-opcua-client versions = 2.0.0, 2.170.0...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +55 more potentially affected by CVE-2026-68904 via node-opcua-client (>=2.10.0, <=2.169.0)

node-opcua-client NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.3.2-alpha.86, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.183, =1.4.15-alpha.61, =1.3.6-alpha.36, =1.4.15-alpha.159, =1.3.5, =1.4.15-alpha.197, =1.4.15-alpha.279, =1.4.15-alpha.182, =1.4.15-alpha.196 and more Source cves:...

CVE-2026-69200

CVE-2026-69200 is a prototype pollution vulnerability in the node-opcua library (an OPC UA implementation for TypeScript/Node.js). The flaw exists in the internal fieldsToJson() method within packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts, which directly assigns unsanitiz...

CVE-2026-69200 node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarmsandconditions/clientalarm.ts directly assigns unsanitized field names and allows a proto.pollutedKey path to modify...

EUVD-2026-80867

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarmsandconditions/clientalarm.ts directly assigns unsanitized field names and allows a proto.pollutedKey path to modify...

CVE-2026-69200 node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarmsandconditions/clientalarm.ts directly assigns unsanitized field names and allows a proto.pollutedKey path to modify...

CVE-2026-69200: Improperly Controlled Modification of Object Prototype Attributes

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarmsandconditions/clientalarm.ts directly assigns unsanitized field names and allows a proto.pollutedKey path to modify...

PT-2026-93840

Name of the Vulnerable Software and Affected Versions node-opcua-client versions prior to 2.145.0 Description The fieldsToJson function in the packages/node-opcua-client/source/alarms and conditions/client alarm.ts file directly assigns unsanitized field names. This allows a proto .pollutedKey pa...