What’s Vulnerable › Vulnerabilities
CVE-2022-24375: Denial of Service (DoS)
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-08-24 · updated 2026-06-17
- Weakness: CWE-400
Description
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
Affected products
- node-opcua: before 2.74.0 — fixed in 2.74.0
How to fix
Upgrade to a fixed version: node-opcua 2.74.0. Check the vendor advisory for mitigations.
References
- https://github.com/node-opcua/node-opcua/commit/3fd46ec156e7718a506be41f3916310b6bdd0407
- https://github.com/node-opcua/node-opcua/commit/7b5044b3f5866fbedc3efabd05e407352c07bd2f
- https://github.com/node-opcua/node-opcua/pull/1182
- https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988725
- https://github.com/node-opcua/node-opcua/commit/3fd46ec156e7718a506be41f3916310b6bdd0407
- https://github.com/node-opcua/node-opcua/commit/7b5044b3f5866fbedc3efabd05e407352c07bd2f
- https://github.com/node-opcua/node-opcua/pull/1182
- https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988725
Get alerted when CVE-2022-24375 or the next vulnerability affects your stack