CVE-2026-69200: falha de baixa gravidade em node-opcua
node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.7epss 0.3%
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption. This vulnerability is fixed in 2.145.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
node-opcua · node-opcuaCVEs relacionadas — node-opcua
No mesmo produto, das mais perigosas para as menos.
CVE-2026-54156HIGHnode-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoSEPSS 0.8%CVE-2026-68904HIGHnode-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource ExhaustionEPSS 0.4%CVE-2026-54155HIGHnode-opcua: Missing nonce verification in UserNameIdentityToken authenticationEPSS 0.4%