CVE-2026-69200 node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)
Prototype pollution in node-opcua allows attackers to corrupt application logic or cause denial of service via unsanitized field names.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-69200?
CVE-2026-69200 is a low-severity vulnerability in node-opcua, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption. This vulnerability is fixed in 2.145.0.
Weakness: CWE-1321
Which versions are affected by CVE-2026-69200?
How do I fix CVE-2026-69200?
No fix has been published for CVE-2026-69200 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-69200 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-69200 exists.
Sources
Also known as GHSA-cv5q-7543-48q4.