CVE-2022-24375
HIGHnode-opcua < 2.74.0 - Denial of Service via Multiple CloseSession Requests
Title source: llmDescription
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
References (4)
Core 4
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/node-opcua/node-opcua/commit/7b5044b3f5866fbedc3efabd05e407352c07bd2f
Patch, Third Party Advisory x_refsource_misc
https://github.com/node-opcua/node-opcua/pull/1182
Patch, Third Party Advisory x_refsource_misc
https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988725
Patch, Third Party Advisory, VDB Entry x_refsource_misc
https://github.com/node-opcua/node-opcua/commit/3fd46ec156e7718a506be41f3916310b6bdd0407
Scores
CVSS v3
7.5
EPSS
0.0125
EPSS Percentile
65.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-400
Status
published
Products (2)
node-opcua_project/node-opcua
< 2.74.0
npm/node-opcua
0 - 2.74.0npm
Published
Aug 24, 2022
Tracked Since
Feb 18, 2026