CVE-2022-24375

The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.

Score

CVSS 3.1 7.5 High

Status

Modified - report@snyk.io

Published

2022-08-24

Last modified

2024-09-16

Weaknesses

CWE-400

Affected products

• Node-opcua (Node-opcua Project)

References

• https://github.com/node-opcua/node-opcua/commit/3fd46ec156e7718a506be41f3916310b6bdd0407
• https://github.com/node-opcua/node-opcua/commit/7b5044b3f5866fbedc3efabd05e407352c07bd2f
• https://github.com/node-opcua/node-opcua/pull/1182
• https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988725