Description
node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses. ClientSessionKeepAliveManager._ping_server treated the server-originated ServiceFault as a network outage and forced a transport reconnect, while ClientTCP_transport._on_ACK_response used socket.end() after failed HEL/ACK negotiation and could leave the connection in FIN-WAIT-2 when the peer did not close. Repetition at the keepAliveInterval accumulates file descriptors and memory until the client process or container can be terminated by resource exhaustion. This issue is fixed in version 2.170.0.
Published: 2026-09-16
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Resource Exhaustion (Denial of Service)
Action: Apply Patch
AI Analysis

Impact

A defect in older node-opcua clients mishandles server scheduled keep‑alive failures caused by clock skew, causing the client to repeatedly reconnect. Each reconnection can leave sockets in a FIN‑WAIT‑2 state, draining file descriptors and memory until the process or container runs out of resources and must be terminated.

Affected Systems

vulnerable versions of node‑opcua range from 2.0.0 through 2.170.0. The issue was resolved in release 2.170.0. Users running these ranges should review their dependency versions.

Risk and Exploitability

With a CVSS score of 7 and an EPSS of less than 1%, the overall exploitation risk is moderate but the impact can be severe if an attacker can induce repeated keep‑alive retries. Based on the description, it is inferred that the vulnerability could be exploited from an external server that repeatedly returns BadInvalidTimestamp responses, forcing the client into the reconnection loop. It is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on September 18, 2026 at 02:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade node‑opcua to version 2.170.0 or later.
  • If an upgrade is not immediately possible, disable keepSessionAlive or lower keepAliveInterval to reduce socket churn.
  • Employ monitoring of open file descriptors and memory usage to detect abnormal growth and trigger alerts or restarts.

Generated by OpenCVE AI on September 18, 2026 at 02:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-r2pf-9cw4-5j65 node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
History

Fri, 18 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Node-opcua Project
Node-opcua Project node-opcua
Vendors & Products Node-opcua Project
Node-opcua Project node-opcua

Wed, 16 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses. ClientSessionKeepAliveManager._ping_server treated the server-originated ServiceFault as a network outage and forced a transport reconnect, while ClientTCP_transport._on_ACK_response used socket.end() after failed HEL/ACK negotiation and could leave the connection in FIN-WAIT-2 when the peer did not close. Repetition at the keepAliveInterval accumulates file descriptors and memory until the client process or container can be terminated by resource exhaustion. This issue is fixed in version 2.170.0.
Title node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}

Subscriptions

Node-opcua Project Node-opcua
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-16T18:34:50.941Z

Reserved: 2026-07-31T21:04:04.039Z

Link: CVE-2026-68904

cve-icon Vulnrichment

Updated: 2026-09-16T18:18:50.743Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-16T17:18:00.917

Modified: 2026-09-30T17:51:36.337

Link: CVE-2026-68904

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T21:51:26Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption