In-app reader
Summary
A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash.
Affected versions: <= 2.165.0
Tested version: 2.165.0
CVSS Score: 7.5 (High)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-770 Allocation of Resources Without Limits or Throttling
Root Cause
In packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts at line 156, g_alreadyUsedNonce is a process-global object used to track previously seen nonces for replay detection. Entries are added on every OpenSecureChannelRequest and every CreateSession request but are never removed or expired.
An unauthenticated attacker can exploit the CreateSession path (which requires no certificate) to accumulate nonce entries indefinitely. Even with maxSessions=10 limiting concurrent sessions, nonces persist after session expiry, allowing slow but reliable heap exhaustion across repeated connection cycles.
Measured Impact
Dynamically confirmed heap growth:
5,000 unique nonces → +1.23 MB resident heap, no eviction after explicit GC
Projected: 10^6 nonces → ~246 MB resident heap
Achievable OOM on default Node.js heap limits
Suggested Fix
Add a TTL-based eviction policy to g_alreadyUsedNonce. Nonces should be expired after the maximum session timeout (or a reasonable fixed window, e.g. 1 hour). A Map with timestamp entries and periodic cleanup is sufficient.
I am following a 90-day responsible disclosure policy. I am happy to provide additional technical details under embargo. Please confirm receipt at your earliest convenience.
Reporter: Stanley Tobias
Discovery date: 2026-03-23
Discussion
Sign in to join the discussion.
Keep reading
Optional: create a free account to save items, track programs, and sync across web + app. Reading stays free.