CVE-2026-54156: Unbounded Nonce Cache in node-opcua Causes DoS Vulnerability

A critical vulnerability (CVE-2026-54156) has been identified in the node-opcua server, allowing unauthenticated remote attackers to exhaust server heap memory by exploiting an unbounded nonce cache. This issue affects versions up to 2.165.0, with a CVSS score of 7.5 (High). The vulnerability arises from a process-global nonce cache that does not implement an eviction policy, leading to potential server crashes. Attackers can repeatedly open sessions to accumulate nonce entries indefinitely, causing a denial-of-service condition. The vulnerability was discovered on March 23, 2026, and a fix has been released in version 2.168.0. Security advisories have been issued to alert users of the risks and the need for immediate updates.

Key Points: • CVE-2026-54156 allows unauthenticated remote attackers to crash node-opcua servers. • Affected versions are up to 2.165.0, with a patch available in version 2.168.0. • The vulnerability exploits an unbounded nonce cache, leading to heap exhaustion.