CVE-2026-54156

node-opcua, an OPC UA stack for TypeScript and Node.js, keeps a process-global cache of client nonces (g_alreadyUsedNonce, checked by nonceAlreadyBeenUsed in server_secure_channel_layer.ts) with no expiration and no size limit. An unauthenticated remote attacker can repeatedly open secure channels and create sessions with unique nonces, and those entries persist even after sessions expire, so heap usage grows without bound regardless of the maxSessions limit. The result is exhaustion of the default Node.js heap and a crash of the node-opcua server process — a pure availability impact (CVSS 3.1: 7.5). Any deployment exposing a node-opcua-based OPC UA server built from a version before 2.166.0 to a network an attacker can reach is affected. The issue is fixed in 2.166.0, and no public proof-of-concept or in-the-wild exploitation is known.

What to do: Upgrade node-opcua to version 2.166.0 or later in any product or service that embeds it, including vendored/copied dependencies. Until patched, restrict access to OPC UA endpoints (typically TCP 4840) to trusted networks via firewall rules or VPN, since no authentication is required to trigger the flaw. Monitor Node.js heap usage and container/process restart events on OPC UA servers for signs of memory growth or crash-looping.