GHSA-MQ36-523M-X7VV node-opcua missing nonce verification in UserNameIdentityToken authentication

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

node-opcua missing nonce verification in UserNameIdentityToken authentication

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

PT-2026-80741

Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. Affected versions: = 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 High CVSS Vecto...

PT-2026-80740

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

PT-2026-80239

Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. Affected versions: = 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 High CVSS Vecto...

PT-2026-80292

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

EUVD-2022-6609

Malicious code in bioql PyPI...

EUVD-2022-6631

Malicious code in bioql PyPI...

EUVD-2024-53528

Malicious code in bioql PyPI...

EUVD-2022-6479

Malicious code in bioql PyPI...

CVE-2024-57086

A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

node-opcua-alarm-condition prototype pollution vulnerability

A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

GHSA-GVWQ-6FMX-28XM node-opcua-alarm-condition prototype pollution vulnerability

A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57086

A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57086: Improperly Controlled Modification of Object Prototype Attributes

A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57086

A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57086

A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57086

The node-opcua-alarm-condition package (version v2.134.0 ) contains a prototype pollution vulnerability within the fieldsToJson function. An attacker can exploit this flaw by supplying a crafted payload to trigger a Denial of Service (DoS) . This vulnerability is transitive across several other p...

CVE-2024-57086

A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

node-opcua security vulnerabilities

node-opcua is a French Sterfive SAS open source implementation of an OPC UA stack written entirely in Typescript for NodeJS. A security vulnerability exists in node-opcua version v2.134.0, which stems from the fieldsToJson function containing a prototype contamination vulnerability...