CVE-2026-54155High· 7.7▾ Twilightnode-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not ve…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.4%
Last analysed / modified upstream
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
node-opcua <= 2.165.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54156High· 7.5node-opcua is an OPC UA implementation for TypeScript and Node.js
CVE-2026-69200Low· 3.7node-opcua is an OPC UA implementation for TypeScript and Node.js
CVE-2025-55311Medium· 6.5An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2
CVE-2026-107724High· 7.4fast-jwt provides fast JSON Web Token (JWT) implementation
CVE-2026-107720High· 7.4fast-jwt provides fast JSON Web Token (JWT) implementation
CVE-2026-107722Critical· 9.8fast-jwt provides fast JSON Web Token (JWT) implementation