CVE-2026-68904— node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
Quick assessment
Affected
node-opcua node-opcua
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
node-opcua 是用于 TypeScript 和 Node.js 的 OPC UA 实现。从版本 2.0.0 到 2.170.0，使用默认 keepSessionAlive 配置的 node-opcua 客户端在 OPC UA 服务器时钟偏移导致返回 BadInvalidTimestamp 错误时，可能陷入重复重连循环。具体原因如下：ClientSessionKeepAliveManager._ping_server 方法将服务器主动发起的 ServiceFault 异常误判为网络中断，从而强制触发传输层重连
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-68904
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
Source: CVE Program / CVE List V5
Vulnerability Description
node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses. ClientSessionKeepAliveManager._ping_server treated the server-originated ServiceFault as a network outage and forced a transport reconnect, while ClientTCP_transport._on_ACK_response used socket.end() after failed HEL/ACK negotiation and could leave the connection in FIN-WAIT-2 when the peer did not close. Repetition at the keepAliveInterval accumulates file descriptors and memory until the client process or container can be terminated by resource exhaustion. This issue is fixed in version 2.170.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| node-opcua | node-opcua | >= 2.0.0, < 2.170.0 | - |
|
II. Public POCs for CVE-2026-68904
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-68904
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-68904 (5)
Other References for CVE-2026-68904 (2)
-
Release v2.170.0 · node-opcua/node-opcua · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: node-opcua
-
CVE-2026-69200
node-opcua: Prototype Pollution via internal `fieldsToJson() -
CVE-2026-54156
node-opcua: Unbounded nonce cache enables unauthenticated he -
CVE-2026-54155
node-opcua: Missing nonce verification in UserNameIdentityTo -
CVE-2022-24375
Denial of Service (DoS) -
CVE-2022-21208
Denial of Service (DoS)
Same weakness: CWE-400
-
CVE-2026-69147
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses st -
CVE-2026-79651
Keycloak-services: keycloak-services: unauthenticated dos vi -
CVE-2026-63128
RMCP: Unauthenticated permanent session-table leak in rmcp S -
CVE-2026-92363
ag-ui-protocol ag-ui JSON sse_parser.cpp resource consumptio -
CVE-2026-92362
ag-ui-protocol ag-ui SSE Frame sse.rs resource consumption
V. Comments for CVE-2026-68904
No comments yet