node-opcua: Resource Exhaustion Vulnerability via Keepalive Reconnection Cycle (CVE-2026-68904)

What happened

node-opcua clients that use the default keepSessionAlive setting can enter a repeated reconnection cycle when connected to an OPC UA server experiencing clock skew. The clock skew causes the server to return BadInvalidTimestamp responses, which the client's keepalive logic misinterprets as a network outage rather than a server-originated fault.

Technical cause

The root cause lies in two components working together. ClientSessionKeepAliveManager._ping_server treats a server-originated ServiceFault (caused by the BadInvalidTimestamp condition) as if it were a network outage, triggering a forced transport reconnect. Separately, ClientTCP_transport._on_ACK_response calls socket.end() after a failed HEL/ACK negotiation, which can leave the TCP connection in a FIN-WAIT-2 state if the remote peer does not close its side. Because this sequence repeats at the configured keepAliveInterval, file descriptors and memory accumulate over time.

Why it matters

The classification is Uncontrolled Resource Consumption (CWE-400). As sockets accumulate in FIN-WAIT-2 and are not released, the client process or its containing environment can eventually be terminated due to resource exhaustion. This can result in a denial of service for applications relying on node-opcua for OPC UA connectivity, with impact described in the CVSS vector as low confidentiality impact, low integrity impact, and high availability impact.

Who is affected

Any application using the node-opcua, node-opcua-transport, or node-opcua-client npm packages with the default keepSessionAlive setting, connecting to an OPC UA server that can exhibit clock skew sufficient to trigger BadInvalidTimestamp responses, is potentially affected.

Affected versions

Versions from 2.0.0 up to (but not including) 2.170.0 of node-opcua, node-opcua-transport, and node-opcua-client are affected.

Fixes and mitigation

The issue is fixed in version 2.170.0 of node-opcua, node-opcua-transport, and node-opcua-client. No alternative mitigation is described in the available facts beyond upgrading.

Recommended action

Update node-opcua and related packages (node-opcua-transport, node-opcua-client) to version 2.170.0 or later. Organizations unable to update immediately should monitor client processes for unusual growth in open file descriptors or sockets stuck in FIN-WAIT-2 as an indicator of this condition.