CVE-2022-25231: 
JavaScript vulnerability analysis and mitigation

CVE-2022-25231 affects the node-opcua package versions before 2.74.0. The vulnerability was discovered by Vera Mens, Uri Katz, and Sharon Brizinov of Team82 (Claroty Research) and was disclosed on August 22, 2022. This vulnerability impacts the OPC UA stack implementation written in JavaScript and NodeJS (Snyk).

The vulnerability is classified as a Denial of Service (DoS) issue with a CVSS v3.1 base score of 7.5 (High). The attack vector is network-based, with low attack complexity and requires no privileges or user interaction. The vulnerability can be exploited by sending a specifically crafted OPC UA message with a special OPC UA NodeID, which triggers excessive memory allocation that exceeds the v8's memory limit (Snyk).

When successfully exploited, this vulnerability results in a total loss of availability, causing the system to become completely unresponsive. The impact is primarily on the availability of the service, while there is no direct impact on confidentiality or integrity. The denial of service condition persists while the attack continues or until the system is restarted (Snyk).

The vulnerability has a high exploitability potential due to its network-based attack vector and low complexity. Snyk has confirmed the existence of a proof-of-concept exploit, and the EPSS (Exploit Prediction Scoring System) indicates a 0.14% probability (52nd percentile) of exploitation in the wild (Snyk).

The recommended mitigation is to upgrade the node-opcua package to version 2.74.0 or higher, which contains the fix for this vulnerability (Snyk).