CVE-2022-24375

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	node-opcua	>= unspecified, < 2.74.0

References

https://github.com/node-opcua/node-opcua/commit/3fd46ec156e7718a506be41f3916310b6bdd0407Patch, Third Party Advisory, VDB Entry
https://github.com/node-opcua/node-opcua/commit/7b5044b3f5866fbedc3efabd05e407352c07bd2fPatch, Third Party Advisory
https://github.com/node-opcua/node-opcua/pull/1182Patch, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988725Patch, Third Party Advisory
https://github.com/node-opcua/node-opcua/commit/3fd46ec156e7718a506be41f3916310b6bdd0407Patch, Third Party Advisory, VDB Entry
https://github.com/node-opcua/node-opcua/commit/7b5044b3f5866fbedc3efabd05e407352c07bd2fPatch, Third Party Advisory
https://github.com/node-opcua/node-opcua/pull/1182Patch, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988725Patch, Third Party Advisory

Timeline

Published: Aug 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-243769.8All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://secur CVE-2022-243779.8The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper CVE-2022-243785.5Improper initialization in the Intel(R) Data Center Manager software before version 4.1 may allow an authenticated user to potentially enabl CVE-2022-243796.7Improper input validation in some Intel(R) Server System M70KLP Family BIOS firmware before version 01.04.0029 may allow a privileged user t CVE-2022-24387.2The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to CVE-2022-243817.5All versions of package asneg/opcuastack are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chu CVE-2022-243826.7Improper input validation in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via l CVE-2022-243837.8The affected product is vulnerable to an out-of-bounds read, which may result in code execution CVE-2022-243846.1Cross-site Scripting (XSS) vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.CVE-2022-243856.5A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTr CVE-2022-243866.1Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.CVE-2022-243877.2With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsetti