Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| node-opcua | npm | < 2.166.0 | 2.166.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a heap exhaustion denial-of-service in node-opcua. According to the advisory, a global nonce cache, g_alreadyUsedNonce, grows indefinitely because there is no eviction policy. This cache is populated with nonces from OpenSecureChannelRequest and CreateSession requests.
Analysis of the source code confirms this. The file packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts contains the ServerSecureChannelLayer class, which handles secure channel communication. The methods #_on_OpenSecureChannelRequest and #_on_common_message_request are the entry points for the vulnerability.
#_on_OpenSecureChannelRequest handles the initial secure channel opening and calls #_check_client_nonce, which in turn calls nonceAlreadyBeenUsed from nonce_cache.ts.
#_on_common_message_request is a generic message handler that processes subsequent requests over the secure channel, including CreateSessionRequest. It also calls nonceAlreadyBeenUsed to check the nonce from the authentication token.
The function nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/nonce_cache.ts is where the vulnerability lies. In the vulnerable version, this function adds nonces to the g_alreadyUsedNonce cache without any mechanism to remove old entries. The patched version introduces an eviction mechanism that limits the size of the cache, thus mitigating the vulnerability.
Therefore, the identified vulnerable functions are the ones that receive the requests and the one that handles the nonce caching.
ServerSecureChannelLayer.#_on_OpenSecureChannelRequestpackages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts
ServerSecureChannelLayer.#_check_client_noncepackages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts
ServerSecureChannelLayer.#_on_common_message_requestpackages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts
nonceAlreadyBeenUsedpackages/node-opcua-secure-channel/source/server/nonce_cache.ts