CVE-2026-54156 node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
Unauthenticated attackers can exhaust server memory by creating unlimited sessions, causing a denial of service in node-opcua applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54156?
CVE-2026-54156 is a high-severity denial of service vulnerability in node-opcua, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create sessions with unique nonces, causing entries to persist after session expiry and accumulate across connection cycles even when maxSessions=10 limits concurrent sessions. The resulting unbounded heap growth can exhaust the default Node.js heap and crash the node-opcua server process. This issue is fixed in version 2.166.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-54156?
2 open source packages ship an affected version, including node-opcua.
| Package | Affected | Fixed in |
|---|---|---|
node-opcua npm | All versions | 2.166.0 |
node-opcua npm | All versions | 2.166.0 |
How do I fix CVE-2026-54156?
Upgrade node-opcua to 2.166.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-54156 being exploited?
There is no known exploitation of CVE-2026-54156 in the wild and no public exploit code.
Sources
Also known as GHSA-6wvw-vrw4-363w.