Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

node-opcua-client

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.0npmAmendedPublished

    node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

    CVE-2026-68904 · GHSA-r2pf-9cw4-5j65

    Affected
    • npm node-opcua-client >= 2.0.0, < 2.170.0
    Fixed in
    2.170.0· Vendor fix available
    Issue
    ------- A combination of bugs in node-opcua causes unlimited TCP socket accumulation (FIN-WAIT-2 state) during automatic reconnection, leading to memory exhaustion and eventual container/process crash (OOM kill). The issue is triggered by the default configuration (keepSessionAlive: true) when the OPC UA server has clock skew relative to the client. Affected version: Tested on 2.169.0 (latest as of April 2026). ENVIRONMENT ----------- - Node.js: v24.11.0 - node-opcua: 2.169.0 - OS: Linux (containerized via Podman, slirp4netns networking) - OPC UA Server: Industrial PLC (opc.tcp endpoint), clock skew of ~50 minutes ahead of client - Client config: keepSessionAlive: true (default), keepAliveInterval: 3000, securityMode: None, securityPolicy: None ROOT CAUSE ANALYSIS ------------------- Bug #1 - ClientTCPtransport.onACKresponse() uses socket.end() instead of socket.destroy() File: node-opcua-transport/src/clienttcptransport.ts, onACKresponse() method When the HEL/ACK handshake…

    Recommended action: Upgrade to 2.170.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →