---
id: CVE-2026-54155
title: node-opcua is an OPC UA implementation for TypeScript and Node.js
summary: >-
  node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to
  2.166.0, the UserNameIdentityToken authentication handler in
  packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP
  password blob but does not ve…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L'
cwe:
  - CWE-347
vendor: node-opcua
product: node-opcua
affected:
  - node-opcua < 2.166.0
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T17:17:46.737'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54155'
references:
  - url: >-
      https://github.com/node-opcua/node-opcua/commit/c6b05738682f5c8d70b1ea275c881f01a1cd9787
    label: security-advisories@github.com
  - url: 'https://github.com/node-opcua/node-opcua/releases/tag/v2.166.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/node-opcua/node-opcua/security/advisories/GHSA-mq36-523m-x7vv
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-mq36-523m-x7vv'
tags:
  - nvd
  - cve.org
  - ghsa
  - npm
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-14T16:39:00.556555Z'
aliases:
  - GHSA-mq36-523m-x7vv
ecosystem: npm
ingestedAt: '2026-08-20T18:59:55.189Z'
epss: 0.00424
epssPercentile: 0.34052
---

## Overview

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54155)

Affected packages:

- `node-opcua <= 2.165.0`

Source: https://github.com/advisories/GHSA-mq36-523m-x7vv