CVE-2026-54156: High severity npm/node-opcua vulnerability
Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash.
Affected versions: <= 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 (High) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE: CWE-770 Allocation of Resources Without Limits or Throttling
---
Root Cause
In packages/node-opcua-secure-channel/source/server/serversecurechannellayer.ts at line 156, galreadyUsedNonce is a process-global object used to track previously seen nonces for replay detection. Entries are added on every OpenSecureChannelRequest and every CreateSession request but are never removed or expired.
An unauthenticated attacker can exploit the CreateSession path (which requires no certificate) to accumulate nonce entries indefinitely. Even with maxSessions=10 limiting concurrent sessions, nonces persist after session expiry, allowing slow but reliable heap exhaustion across repeated connection cycles.
---
Measured Impact
Dynamically confirmed heap growth: - 5,000 unique nonces → +1.23 MB resident heap, no eviction after explicit GC - Projected: 10^6 nonces → ~246 MB resident heap - Achievable OOM on default Node.js heap limits
---
Suggested Fix
Add a TTL-based eviction policy to galreadyUsedNonce. Nonces should be expired after the maximum session timeout (or a reasonable fixed window, e.g. 1 hour). A Map with timestamp entries and periodic cleanup is sufficient.
---
I am following a 90-day responsible disclosure policy. I am happy to provide additional technical details under embargo. Please confirm receipt at your earliest convenience.
Reporter: Stanley Tobias Discovery date: 2026-03-23
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/node-opcuato a version that resolves this vulnerability.Fixed in 2.168.0 - Upgrade
Upgrade
node-opcua (node-opcua-secure-channel)to a version that resolves this vulnerability.Fixed in 2.165.0 - Configuration
In packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts (line ~156), replace the process-global g_alreadyUsedNonce nonce cache (currently no eviction/expiration) with a TTL-based eviction policy so nonce entries expire after the maximum session timeout or a reasonable fixed window; ensure entries are removed/expired rather than persisting indefinitely.
node-opcua-secure-channel g_alreadyUsedNonce (nonce cache) = TTL-based eviction policy
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker able to connect to a node-opcua server can exploit the CreateSession path. No credentials, certificate, or user interaction are required.
Does limiting the number of concurrent sessions prevent exploitation?
No. A maxSessions setting such as maxSessions=10 limits concurrent sessions, but nonce entries remain after sessions expire. An attacker can repeat connection cycles over time to continue consuming heap memory.
What versions are affected?
node-opcua versions 2.165.0 and earlier are affected. The issue was tested and dynamically confirmed in version 2.165.0.
How can I tell whether a server is under attack or affected?
Monitor the node-opcua server process for sustained resident heap growth associated with repeated OpenSecureChannelRequest or CreateSession activity. The documented measurement showed approximately 1.23 MB of resident heap growth after 5,000 unique nonces.
What is the impact if exploitation succeeds?
Repeated requests can exhaust process heap memory and crash the node-opcua server process, causing a denial of service. The vulnerability affects availability; no confidentiality or integrity impact is stated.