GHSA-6wvw-vrw4-363w: High severity npm/node-opcua vulnerability
Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash.
Affected versions: <= 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 (High) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE: CWE-770 Allocation of Resources Without Limits or Throttling
---
Root Cause
In packages/node-opcua-secure-channel/source/server/serversecurechannellayer.ts at line 156, galreadyUsedNonce is a process-global object used to track previously seen nonces for replay detection. Entries are added on every OpenSecureChannelRequest and every CreateSession request but are never removed or expired.
An unauthenticated attacker can exploit the CreateSession path (which requires no certificate) to accumulate nonce entries indefinitely. Even with maxSessions=10 limiting concurrent sessions, nonces persist after session expiry, allowing slow but reliable heap exhaustion across repeated connection cycles.
---
Measured Impact
Dynamically confirmed heap growth: - 5,000 unique nonces → +1.23 MB resident heap, no eviction after explicit GC - Projected: 10^6 nonces → ~246 MB resident heap - Achievable OOM on default Node.js heap limits
---
Suggested Fix
Add a TTL-based eviction policy to galreadyUsedNonce. Nonces should be expired after the maximum session timeout (or a reasonable fixed window, e.g. 1 hour). A Map with timestamp entries and periodic cleanup is sufficient.
---
I am following a 90-day responsible disclosure policy. I am happy to provide additional technical details under embargo. Please confirm receipt at your earliest convenience.
Reporter: Stanley Tobias Discovery date: 2026-03-23
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/node-opcuato a version that resolves this vulnerability.Fixed in 2.168.0 - Configuration
Add a TTL-based eviction policy to the process-global nonce cache `g_alreadyUsedNonce` so nonce entries are expired/removed after the maximum session timeout (or a reasonable fixed window), preventing indefinite growth and heap exhaustion.
packages/node-opcua-secure-channel (server_secure_channel_layer.ts) g_alreadyUsedNonce = TTL-based eviction after reasonable fixed window / maximum session timeout
Event History
Frequently Asked Questions
Does limiting maxSessions prevent this denial of service?
No. Although maxSessions=10 limits concurrent sessions, nonce entries remain after sessions expire, so repeated connection cycles can still accumulate entries indefinitely.
What access does an attacker need?
An attacker only needs network access to the node-opcua server. The CreateSession path does not require a certificate, authentication, or user interaction.
How can active exploitation or exposure manifest?
The server process's resident heap grows as unique nonces accumulate and can eventually crash. Testing measured approximately 1.23 MB of additional resident heap after 5,000 unique nonces.