CVE-2026-69200: node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarmsandconditions/clientalarm.ts directly assigns unsanitized field names and allows a proto.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption. This vulnerability is fixed in 2.145.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-opcua-clientto a version that resolves this vulnerability.Fixed in 2.145.0Patch CVE-2024-57086
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments using node-opcua-client versions before 2.145.0 are exposed only if their application passes attacker-controlled event fields to the internal fieldsToJson method. Applications that do not expose such fields to this method are not described as exploitable.
What does an attacker need to exploit this issue?
An attacker needs control over event field names that reach fieldsToJson. A field path such as __proto__.pollutedKey can then modify Object.prototype.
What is the impact of successful exploitation?
The reported impacts are denial of service and application logic corruption. The vulnerability does not report confidentiality or integrity impacts in its severity vector.
What should be done if upgrading cannot happen immediately?
Prevent attacker-controlled event fields from being passed to fieldsToJson. In particular, reject or otherwise handle field names that could traverse __proto__ paths until node-opcua-client can be updated to 2.145.0.