CVE-2026-69200
LowCVSS 3.7Summary
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption.
Risk Assessment
Prototype pollution may occur, leading to denial of service or unpredictable application logic behavior in applications using node-opcua.
Recommendation
Upgrade node-opcua-client to version 2.145.0 or later. Ensure the application does not pass untrusted event field names to fieldsToJson.
Other vulnerabilities in node-opcua
See all- CVE-2026-68904High
node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses, accumulating file descriptors and memory until resource exhaustion. This issue is fixed in version 2.170.0.
- CVE-2026-54156High
node-opcua before version 2.166.0 stores nonces in a global cache without expiration or size limit. An unauthenticated attacker can repeatedly create sessions with unique nonces, causing unbounded heap growth and crashing the server.
- CVE-2026-54155High
node-opcua before version 2.166.0 in UserNameIdentityToken handling does not verify that trailing bytes match the current serverNonce. This allows an attacker to forge a token with an empty password or replay a captured token in another session.
Original NVD description (English source)
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption. This vulnerability is fixed in 2.145.0.