node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the…
Historical advisory recorded 25 Oct 2026 13:17:22 UTC. Read the latest advisory.
nvd · CVE-2026-54155
Publishednode-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0.
Read the publisher's advisoryAffected versions, risk and source history
nvd · CVE-2026-54155
PublishedNVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Awaiting Analysis
Weakness classifications: CWE-347
Original publisher date fields
published: 2026-09-14T17:17:46.737
lastModified: 2026-09-30T19:38:27.293
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON