node-opcua: Fix Unbounded Nonce Cache Growth in Secure Channel

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Type: Memory growth issue in the nonce cache within the secure-channel. Issue Description: The nonce storage in grows unbounded without any limits, leading to memory leaks/leakage. Fix Approach: The original plain object was replaced with a TTL-based nonce cache (4-hour expiration) + a maximum capacity limit (50,000 entries) + an LRU-based eviction policy. Commit Information: , author , commit hash . Scope of Impact Affected files (3 files changed, +282 / -21): 1. (newly added, +100) 2. (modified, +32 / -22) 3. (newly added test, +155) Affected module: The nonce management logic in the OPC UA secure-channel. Fix Details Added , implementing a nonce cache with TTL and maximum capacity limits: - (4 hours) - - Uses a to maintain insertion order, implementing LRU eviction: entries are evicted starting from the oldest when the TTL expires or the maxsize is exceeded. - Provides interfaces such as , , , and . In , the original global nonce storage was replaced with the new nonce cache, and the interface and are exported. Added the new test file , covering the following scenarios: - Basic behavior: server-side nonce returns false, resubmitting the same nonce returns true, an undefined nonce returns false, an empty nonce returns false, and an all-zero Buffer returns false. - TTL Expiration: A nonce can be accepted again after its TTL expires. - Maxsize Limit: When the limit is exceeded, the oldest entries are evicted while the newest entries are retained. - Replaying a nonce within the TTL window is still detected. POC / Exploit Code (Test Code Block)

Goal Reached Thanks to every supporter — we hit 100%!

node-opcua: Fix Unbounded Nonce Cache Growth in Secure Channel

More from this source