Vulnerability GHSA-4hr4-pjjh-2q2w
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 years ago
August 24, 2022 at 12:00 AM UTC
Uncontrolled Resource Consumption in node-opcua
0.0.1 - 2.73.1
0.0.1 - 2.73.1
Summary
Uncontrolled Resource Consumption in node-opcua
Details
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
13 hours ago
node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions
2.42.0 - 2.179.0 GHSA-xggf-m53x-jc3f
2.42.0 - 2.179.0 GHSA-xggf-m53x-jc3f
High Risk
1 month ago
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
2.0.0 - 2.169.0 GHSA-r2pf-9cw4-5j65
2.0.0 - 2.169.0 GHSA-r2pf-9cw4-5j65
High Risk
2 months ago
node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
0.0.1 - 2.165.2 GHSA-6wvw-vrw4-363w
0.0.1 - 2.165.2 GHSA-6wvw-vrw4-363w
High Risk
2 months ago
node-opcua missing nonce verification in UserNameIdentityToken authentication
0.0.1 - 2.165.0 GHSA-mq36-523m-x7vv
0.0.1 - 2.165.0 GHSA-mq36-523m-x7vv
High Risk
4 years ago
node-opcua DoS when bypassing limitations for excessive memory consumption
0.0.1 - 2.73.1 GHSA-vh4f-fgpp-x8x2
0.0.1 - 2.73.1 GHSA-vh4f-fgpp-x8x2
Impacted packages
Timeline
Published
4 years ago
August 24, 2022 at 12:00 AM UTC
Fixed (2.74.0)
4 years ago
August 13, 2022 at 09:48 AM UTC
Last Modified
3 years ago
November 08, 2023 at 04:08 AM UTC