{"vulnerability": "ghsa-r2pf-9cw4-5j65", "sightings": [{"uuid": "a2d474d3-5d41-4c3c-8605-acdcf0fa9adb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-r2pf-9cw4-5j65", "type": "seen", "source": "https://gist.github.com/alon710/ca48de2f64cb21c4b6fdba639af7e2ac", "content": "# CVE-2026-68904: CVE-2026-68904: Uncontrolled Resource Consumption (Socket Leak and Reconnection Storm) in node-opcua\n\n> **CVSS Score:** 7.0\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-68904\n\n## Summary\nCVE-2026-68904 is a high-severity Denial of Service (DoS) vulnerability in the node-opcua library. It arises from a logical flaw in the keepalive session manager combined with incorrect socket termination at the TCP transport layer. When server-side anomalies occur, affected clients fall into an infinite, high-frequency reconnection loop. Due to the use of graceful teardown (socket.end) instead of immediate termination (socket.destroy) during negotiation failures, sockets remain open in the FIN-WAIT-2 state. This accumulates system file descriptors and memory, eventually crashing the client process.\n\n## TL;DR\nA socket leak and logic comparison bug in node-opcua client keepalives triggers an infinite, high-frequency reconnection storm. The improper socket teardown leaves connections in FIN-WAIT-2 indefinitely, exhausting system file descriptors and causing client-side crashes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400: Uncontrolled Resource Consumption\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.0 (High)\n- **EPSS Score**: Not Available\n- **Impact**: Availability (High) - Client Process Crash\n- **Exploit Status**: PoC / Functional Test Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js client applications utilizing the node-opcua package in vulnerable versions.\n- **node-opcua**: >= 2.0.0, < 2.170.0 (Fixed in: `2.170.0`)\n\n## Mitigation\n\n- Upgrade node-opcua to version 2.170.0 or later.\n- Reduce system-level TCP FIN-WAIT-2 timeout settings via sysctl.\n- Implement NTP synchronization to reduce clock skew and prevent ServiceFault generation.\n\n**Remediation Steps:**\n1. Open your project's package.json file.\n2. Locate the node-opcua dependency and update the version string to ^2.170.0.\n3. Run your package manager install command (e.g., npm install or yarn install) to update lockfiles.\n4. Apply the sysctl command 'sysctl -w net.ipv4.tcp_fin_timeout=15' on the production host to defend against raw socket exhaustion.\n\n## References\n\n- [GHSA-r2pf-9cw4-5j65: Uncontrolled Resource Consumption in node-opcua](https://github.com/node-opcua/node-opcua/security/advisories/GHSA-r2pf-9cw4-5j65)\n- [CVE-2026-68904 Record](https://www.cve.org/CVERecord?id=CVE-2026-68904)\n- [node-opcua Pull Request 1497](https://github.com/node-opcua/node-opcua/pull/1497)\n- [node-opcua Version v2.170.0 Release Notes](https://github.com/node-opcua/node-opcua/releases/tag/v2.170.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-68904) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T17:31:30.429832Z"}]}