CVE-2026-54155
HighCVSS 7.7Summary
node-opcua before version 2.166.0 in UserNameIdentityToken handling does not verify that trailing bytes match the current serverNonce. This allows an attacker to forge a token with an empty password or replay a captured token in another session.
Risk Assessment
The risk includes compromise of accounts accepting empty passwords and replay attacks, potentially leading to unauthorized access to OPC UA systems.
Recommendation
Upgrade node-opcua to version 2.166.0 or later and enforce secure SecurityMode settings.
Other vulnerabilities in node-opcua
See all- CVE-2026-69200Low
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption.
- CVE-2026-68904High
node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses, accumulating file descriptors and memory until resource exhaustion. This issue is fixed in version 2.170.0.
- CVE-2026-54156High
node-opcua before version 2.166.0 stores nonces in a global cache without expiration or size limit. An unauthenticated attacker can repeatedly create sessions with unique nonces, causing unbounded heap growth and crashing the server.
Original NVD description (English source)
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0.