Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. Affected versions: <= 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 (High) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE: CWE-770 Allocation of Resources Without Limits or Throttling Root Cause In packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts at line 156, g_alreadyUsedNonce is a process-global object used to track previously seen nonces for replay detection. Entries are added on every OpenSecureChannelRequest and every CreateSession request but are never removed or expired. An unauthenticated attacker can exploit the CreateSession path (which requires no certificate) to accumulate nonce entries indefinitely. Even with maxSessions=10 limiting concurrent sessions, nonces persist after session expiry, allowing slow but reliable heap exhaustion across repeated connection cycles. Measured Impact Dynamically confirmed heap growth:- 5,000 unique nonces → +1.23 MB resident h...
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub Advisories released a security advisory .
Feedly found the first article mentioning CVE-2026-54156 . See article
Detection for the vulnerability has been added to Qualys ( 5017105 )
CVE-2026-54156 [HIGH] [reviewed] node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
SCA: security update for node-opcua (GHSA-6wvw-vrw4-363w)
node-opcua (fixed: 2.168.0) (npm) — node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
