Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

node-opcua-server

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.1npmAmendedPublished

    node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

    CVE-2026-95860 · GHSA-xggf-m53x-jc3f

    Affected
    • npm node-opcua-server >= 2.42.0, < 2.180.0
    Fixed in
    2.180.0· Vendor fix available
    Issue
    An unauthenticated (Anonymous) client can Write protected Variables and Call privileged Methods on any Node that lacks explicit per-node permissions. This follows the inheritance model defined by OPC UA Part 3, §5.2.9, where nodes without an explicit `RolePermissions` attribute inherit the namespace `DefaultRolePermissions`. OPC 10000-3 §4.8.3 mandates a default-deny evaluation (`Bad_UserAccessDenied` when the operation bits are not set); `node-opcua` instead grants all permissions. The root cause is a combination of an authorization fail-open and a disconnect between the configuration API and the runtime enforcement path. --- Affected configuration This advisory covers two cases that are not equally severe: 1. No RolePermissions declared anywhere - resolution is permissive. This is node-opcua's documented behaviour for a server with no access control configured, so nothing is being bypassed. Worth fixing as an insecure default (CWE-1188),…

    Recommended action: Upgrade to 2.180.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →