GHSA-VH4F-FGPP-X8X2 node-opcua DoS when bypassing limitations for excessive memory consumption

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/local-client (>=1.3.6-alpha.36, <=1.4.14) +17 more potentially affected by CVE-2022-24375 via node-opcua (>=2.10.0, <=2.73.1)

node-opcua NPM version =2.10.0, =1.1.7, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =1.1.0, =0.2.11-3.1, =0.2.113 and more Source cves: CVE-2022-24375 Source advisory: OSV:GHSA-VH4F-FGPP-X8X2...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/local-client (>=1.3.6-alpha.36, <=1.4.14) +17 more potentially affected by CVE-2022-24375 via node-opcua (>=2.10.0, <=2.73.1)

node-opcua NPM version =2.10.0, =1.1.7, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =1.1.0, =0.2.11-3.1, =0.2.113 and more Source cves: CVE-2022-24375 Source advisory: GHSA-VH4F-FGPP-X8X2...

CVE-2022-24375

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

CVE-2022-24375

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

CVE-2022-24375 Denial of Service (DoS)

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

CVE-2022-24375 Denial of Service (DoS)

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

CVE-2022-24375

The CVE-2022-24375, observed in the node-opcua package, is a DoS vulnerability that occurs when an attacker bypasses memory-consumption limits by sending multiple CloseSession requests with deleteSubscription set to False. Affected are versions prior to 2.74.0. The root cause is improper resource...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/local-client (>=1.3.6-alpha.36, <=1.4.14) +34 more potentially affected by CVE-2022-24375 via node-opcua (>=0.0.49, <=2.73.1)

node-opcua NPM version =0.0.49, =1.1.7, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =0.5.0, =0.1.1, =0.1.0, =0.0.1, =1.0.2, =1.0.3 and more Source cves: CVE-2022-24375 Source advisory: MEND:CVE-2022-24375...

CVE-2022-24375

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/local-client (>=1.3.6-alpha.36, <=1.4.14) +17 more potentially affected by CVE-2022-25231 via node-opcua (>=2.10.0, <=2.73.1)

node-opcua NPM version =2.10.0, =1.1.7, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =1.1.0, =0.2.11-3.1, =0.2.113 and more Source cves: CVE-2022-25231 Source advisory: OSV:GHSA-QPGC-XH7J-52Q8...

node-opcua DoS vulnerability via message with memory allocation that exceeds v8's memory limit

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit...

GHSA-4HR4-PJJH-2Q2W Uncontrolled Resource Consumption in node-opcua

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks e.g. 2GB...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/local-client (>=1.3.6-alpha.36, <=1.4.14) +17 more potentially affected by CVE-2022-25231 via node-opcua (>=2.10.0, <=2.73.1)

node-opcua NPM version =2.10.0, =1.1.7, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =1.1.0, =0.2.11-3.1, =0.2.113 and more Source cves: CVE-2022-25231 Source advisory: GHSA-QPGC-XH7J-52Q8...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/local-client (>=1.3.6-alpha.36, <=1.4.14) +17 more potentially affected by CVE-2022-21208 via node-opcua (>=2.10.0, <=2.73.1)

node-opcua NPM version =2.10.0, =1.1.7, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =1.1.0, =0.2.11-3.1, =0.2.113 and more Source cves: CVE-2022-21208 Source advisory: OSV:GHSA-4HR4-PJJH-2Q2W...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/local-client (>=1.3.6-alpha.36, <=1.4.14) +17 more potentially affected by CVE-2022-21208 via node-opcua (>=2.10.0, <=2.73.1)

node-opcua NPM version =2.10.0, =1.1.7, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =1.1.0, =0.2.11-3.1, =0.2.113 and more Source cves: CVE-2022-21208 Source advisory: GHSA-4HR4-PJJH-2Q2W...

CVE-2022-24375: Uncontrolled Resource Consumption

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

CVE-2022-21208

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks e.g. 2GB...

CVE-2022-25231

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit...

Design/Logic Flaw

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit...