CVE-2026-54156
Received Received - Intake

Memory Exhaustion in node-opcua Due to Unbounded Nonce Cache

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create sessions with unique nonces, causing entries to persist after session expiry and accumulate across connection cycles even when maxSessions=10 limits concurrent sessions. The resulting unbounded heap growth can exhaust the default Node.js heap and crash the node-opcua server process. This issue is fixed in version 2.166.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54156
EUVD
EUVD-2026-77624

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
node-opcua node-opcua 2.166.0
node-opcua node-opcua to 2.166.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory exhaustion issue in the node-opcua library affecting versions prior to 2.166.0. It involves a process-global nonce cache that stores nonces without expiration or size limits. Attackers can repeatedly create sessions with unique nonces, causing the cache to grow indefinitely and exhaust server heap memory, leading to crashes.

Detection Guidance

Monitor Node.js process memory usage for unexpected growth. Check for repeated OpenSecureChannelRequest or CreateSession calls with unique nonces. Use tools like ps, top, or Node.js heap snapshots to detect unbounded heap growth.

Impact Analysis

An unauthenticated remote attacker can exploit this to crash the node-opcua server by consuming all available memory. This disrupts service availability and may require manual intervention to restart the server. The attack requires no privileges or user interaction.

Compliance Impact

This vulnerability primarily impacts availability by causing server crashes due to memory exhaustion, which could lead to service disruptions. For GDPR, this may affect the integrity and availability of personal data processing systems, potentially violating Article 32 requirements for security. HIPAA could be impacted if the affected system handles protected health information, as downtime may disrupt access to critical data.

Mitigation Strategies

Upgrade node-opcua to version 2.166.0 or later. Implement a TTL-based eviction policy for nonce cache if using an older version. Monitor server memory and restart processes if heap exhaustion is detected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54156. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart