Vulnerability GHSA-r2pf-9cw4-5j65

SUMMARY

A combination of bugs in node-opcua causes unlimited TCP socket accumulation (FIN-WAIT-2 state) during automatic reconnection, leading to memory exhaustion and eventual container/process crash (OOM kill). The issue is triggered by the default configuration (keepSessionAlive: true) when the OPC UA server has clock skew relative to the client.

Affected version: Tested on 2.169.0 (latest as of April 2026).

ENVIRONMENT

• Node.js: v24.11.0
• node-opcua: 2.169.0
• OS: Linux (containerized via Podman, slirp4netns networking)
• OPC UA Server: Industrial PLC (opc.tcp endpoint), clock skew of ~50 minutes ahead of client
• Client config: keepSessionAlive: true (default), keepAliveInterval: 3000, securityMode: None, securityPolicy: None

ROOT CAUSE ANALYSIS

Bug #1 - ClientTCP_transport._on_ACK_response() uses socket.end() instead of socket.destroy()

File: node-opcua-transport/src/client_tcp_transport.ts, _on_ACK_response() method

When the HEL/ACK handshake fails during a reconnection attempt, the error handler calls socket.end():

if (err || !data) {
    externalCallback(err || new Error("no data"));
    if (this._socket) {
        this._socket.end();   // <- sends TCP FIN, leaves socket in FIN-WAIT-2
    }
}

socket.end() sends a TCP FIN and waits for the peer to close its side. If the peer doesn't respond (common with PLCs), the socket remains in FIN-WAIT-2 state indefinitely, leaking file descriptors and memory. During rapid reconnection cycles (triggered by Bug #2 below), every failed HEL/ACK creates a new leaked socket.