Node-opcua Client Vulnerability and Reconnection Cycle Issue

CVE-2026-68904

What is CVE-2026-68904?

The node-opcua library, an implementation for TypeScript and Node.js, has a significant vulnerability where clients using the default keepSessionAlive setting can find themselves in an endless reconnection loop due to clock skew on the OPC UA server. This leads to repeated 'BadInvalidTimestamp' responses that the ClientSessionKeepAliveManager mistakes for a network outage. The faulty logic in managing these service faults results in unnecessary transport reconnects, causing an accumulation of file descriptors and excessive memory consumption. Ultimately, this can lead to resource exhaustion, which may terminate the client process or container. The issue is resolved in version 2.170.0.

References