CVE-2026-68904

node-opcua, the most widely used open-source OPC UA implementation for Node.js, contains a resource-exhaustion flaw (CWE-400) in which every failed reconnection leaves a TCP socket stranded in FIN-WAIT-2 state, leaking file descriptors and memory until the process or container is killed by the OOM killer. No attacker interaction is required: with the default keepSessionAlive: true setting, a server clock skewed beyond the server's timestamp tolerance (e.g., an industrial PLC roughly 50 minutes ahead of the client) makes the keepalive manager misread the resulting BadInvalidTimestamp fault as a network outage and force a full transport reconnect every keepAliveInterval, while the failed HEL/ACK handshake path calls socket.end() instead of socket.destroy(), so sockets the PLC never closes accumulate indefinitely. At the commonly used 3-second keepAliveInterval this is about 20 leaked sockets per minute (~1,200 per hour), so an attacker who controls or spoofs a skewed, non-responsive OPC UA endpoint — or simple clock misconfiguration — can crash the Node.js client application, gateway, or SCADA data bridge (CVSS 3.1 7.0 High, availability-focused). Any node-opcua client deployment carries the flawed code (confirmed on 2.169.0, the latest release as of April 2026), but only installations communicating with clock-skewed or non-responding servers actually leak; no public proof-of-concept or in-the-wild exploitation is known.

What to do: No fixed version is named in the advisory, so watch node-opcua releases beyond 2.169.0 and upgrade as soon as a patch lands; in the interim, either disable keepSessionAlive or lengthen keepAliveInterval, and enforce NTP time synchronization (or raise the server's accepted timestamp tolerance) so client request timestamps stay within the server's window. Monitor FIN-WAIT-2 socket counts on client hosts and apply container file-descriptor/memory limits so any leak surfaces as a bounded, restartable failure rather than a silent OOM crash.