DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-68904: CVE-2026-68904: Uncontrolled Resource Consumption (Socket Leak and Reconnection Storm) in node-opcua

#security #cve #cybersecurity

CVE-2026-68904: Uncontrolled Resource Consumption (Socket Leak and Reconnection Storm) in node-opcua

Vulnerability ID: CVE-2026-68904
CVSS Score: 7.0
Published: 2026-09-16

CVE-2026-68904 is a high-severity Denial of Service (DoS) vulnerability in the node-opcua library. It arises from a logical flaw in the keepalive session manager combined with incorrect socket termination at the TCP transport layer. When server-side anomalies occur, affected clients fall into an infinite, high-frequency reconnection loop. Due to the use of graceful teardown (socket.end) instead of immediate termination (socket.destroy) during negotiation failures, sockets remain open in the FIN-WAIT-2 state. This accumulates system file descriptors and memory, eventually crashing the client process.

TL;DR

A socket leak and logic comparison bug in node-opcua client keepalives triggers an infinite, high-frequency reconnection storm. The improper socket teardown leaves connections in FIN-WAIT-2 indefinitely, exhausting system file descriptors and causing client-side crashes.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400: Uncontrolled Resource Consumption
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.0 (High)
  • EPSS Score: Not Available
  • Impact: Availability (High) - Client Process Crash
  • Exploit Status: PoC / Functional Test Available
  • KEV Status: Not Listed

Affected Systems

  • Node.js client applications utilizing the node-opcua package in vulnerable versions.
  • node-opcua: >= 2.0.0, < 2.170.0 (Fixed in: 2.170.0)

Code Analysis

Commit: 1959cbb

Release Socket Immediately on HEL/ACK Failure

Commit: 4d59197

Distinguish Server-Originated Faults from Transport Errors

Commit: 481664f

Implement Exponential Backoff for Reconnection

Commit: dc406fd

StatusCode Method Comparison (.equals)

Mitigation Strategies

  • Upgrade node-opcua to version 2.170.0 or later.
  • Reduce system-level TCP FIN-WAIT-2 timeout settings via sysctl.
  • Implement NTP synchronization to reduce clock skew and prevent ServiceFault generation.

Remediation Steps:

  1. Open your project's package.json file.
  2. Locate the node-opcua dependency and update the version string to ^2.170.0.
  3. Run your package manager install command (e.g., npm install or yarn install) to update lockfiles.
  4. Apply the sysctl command 'sysctl -w net.ipv4.tcp_fin_timeout=15' on the production host to defend against raw socket exhaustion.

References

Read the full report for CVE-2026-68904 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)