-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from uncontrolled memory allocation when processing OPC UA messages with crafted NodeIDs. The commit shows critical fixes in RegisterNodes/UnregisterNodes handlers where empty/invalid requests previously triggered normal processing flows. By replacing response mechanisms with ServiceFault errors (CVE-2022-25231 patch), the developers addressed scenarios where malicious NodeID arrays could cause v8 memory exhaustion. The server-side request handlers in opcua_server.ts were vulnerable due to missing input validation guards against oversized/empty NodeID collections.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| node-opcua | npm | < 2.74.0 | 2.74.0 |