CVE-2026-54156: 
JavaScript vulnerability analysis and mitigation

CVE-2026-54156 is a Denial-of-Service vulnerability in the node-opcua npm package, described as an unbounded nonce cache enabling unauthenticated heap exhaustion. It affects all versions up to and including 2.165.0 and was discovered by Stanley Tobias on 2026-03-23, with the advisory published on 2026-07-03 and added to the GitHub Advisory Database on 2026-08-20. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, node-opcua Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). In packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts at line 156, a process-global object g_alreadyUsedNonce is used for replay-attack detection by tracking previously seen nonces. Entries are appended on every OpenSecureChannelRequest and CreateSession request but are never removed or expired. An unauthenticated attacker can exploit the CreateSession path — which requires no client certificate — to continuously accumulate nonce entries; even with maxSessions=10 limiting concurrent sessions, nonces persist after session expiry, enabling slow but reliable heap exhaustion across repeated connection cycles (GitHub Advisory, node-opcua Advisory).

Successful exploitation causes the node-opcua server process to crash due to an out-of-memory (OOM) condition, resulting in a complete loss of availability for any OPC UA service built on this library. Measured heap growth confirms that 5,000 unique nonces add approximately 1.23 MB of resident heap with no eviction after explicit garbage collection; projections indicate that 10^6 nonces would consume roughly 246 MB, which is sufficient to exhaust default Node.js heap limits. There is no confidentiality or integrity impact — the attack is purely a Denial-of-Service (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The attack requires no authentication, no special privileges, and no user interaction, making it trivially accessible to any network-reachable attacker. The CVE status is listed as "Reserved" and it has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No EPSS score is currently available (GitHub Advisory).

1. Reconnaissance: Identify internet- or network-facing OPC UA servers running node-opcua version ≤ 2.165.0 using OPC UA discovery tools or network scanners targeting the default OPC UA port (TCP 4840).
2. Establish connection: Open a TCP connection to the target OPC UA server endpoint without providing any client certificate.
3. Send CreateSession requests in a loop: Repeatedly send CreateSession requests, each with a unique, randomly generated nonce value. No authentication is required for this OPC UA service call.
4. Cycle connections: After each session is established or expires (respecting the maxSessions limit), close the connection and open a new one, then repeat step 3. Because nonces are never evicted from g_alreadyUsedNonce, each cycle permanently grows the server's heap.
5. Achieve heap exhaustion: Continue the loop until the Node.js process exceeds its heap limit and crashes with an OOM error, taking the OPC UA server offline (GitHub Advisory, node-opcua Advisory).

• Network: High volume of repeated TCP connections to OPC UA port (default 4840) from a single or small set of source IPs; rapid session open/close cycles with no legitimate OPC UA traffic patterns.
• Process: Node.js process hosting node-opcua exhibiting continuously growing heap memory usage (observable via process.memoryUsage() or external monitoring); eventual process crash with a JavaScript heap out-of-memory error.
• Logs: OPC UA server logs showing a large number of CreateSession requests from the same client address in a short time window; log entries indicating session creation followed immediately by session expiry or disconnection in rapid succession.
• System: Operating system OOM killer events or unexpected node process restarts; alerts from process supervisors (e.g., PM2, systemd) indicating repeated crashes of the OPC UA server service.

Upgrade node-opcua to version 2.168.0 or later, which is the patched release addressing this vulnerability (node-opcua Release). The suggested fix is to add a TTL-based eviction policy to g_alreadyUsedNonce, expiring nonces after the maximum session timeout or a fixed window (e.g., 1 hour) using a Map with timestamp entries and periodic cleanup. As a short-term workaround where upgrading is not immediately possible, restrict network access to the OPC UA port (TCP 4840) using firewall rules to trusted clients only, reducing the attack surface for unauthenticated remote exploitation (GitHub Advisory).