node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

published 2026-09-16 54 d ago modified 2026-09-30 40 d ago also EUVD-2026-80869 , GHSA-r2pf-9cw4-5j65

cvss: 7.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits: 0; none known

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses. ClientSessionKeepAliveManager._ping_server treated the server-originated ServiceFault as a network outage and forced a transport reconnect, while ClientTCP_transport._on_ACK_response used socket.end() after failed HEL/ACK negotiation and could leave the connection in FIN-WAIT-2 when the peer did not close. Repetition at the keepAliveInterval accumulates file descriptors and memory until the client process or container can be terminated by resource exhaustion. This issue is fixed in version 2.170.0.

Patch / fix

fixed in 4 links 6

npm node-opcua-transport 2.170.0
npm node-opcua-client 2.170.0
npm node-opcua 2.170.0
node-opcua_project node-opcua 2.170.0

github.com/node-opcua/node-opcua@1959cbb commit
github.com/node-opcua/node-opcua@481664f commit
github.com/node-opcua/node-opcua@4d59197 commit
github.com/node-opcua/node-opcua@dc406fd commit
github.com/node-opcua/node-opcua#1497 pull request
github.com/node-opcua/node-opcua/releases/tag/v2.170.0 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 53 d ago (2026-09-16)

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
GitHub	3.1	7.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	node-opcua-transport	>=2.0.0, <2.170.0	2.170.0
npm	node-opcua-client	>=2.0.0, <2.170.0	2.170.0
npm	node-opcua	>=2.0.0, <2.170.0	2.170.0

Affected products

node-opcua node-opcua

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary