CVE-2022-25231

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
n/a	node-opcua	>= unspecified, < 2.74.0

References

https://github.com/node-opcua/node-opcua/commit/7b5044b3f5866fbedc3efabd05e407352c07bd2fPatch, Third Party Advisory
https://github.com/node-opcua/node-opcua/pull/1182Patch, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988724Third Party Advisory
https://github.com/node-opcua/node-opcua/commit/7b5044b3f5866fbedc3efabd05e407352c07bd2fPatch, Third Party Advisory
https://github.com/node-opcua/node-opcua/pull/1182Patch, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988724Third Party Advisory

Timeline

Published: Aug 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-252347.8Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause i CVE-2022-252359.8xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is val CVE-2022-252369.8xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.CVE-2022-252379.8Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the Rest CVE-2022-252385.4Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an CVE-2022-252418.8In FileCloud before 21.3, the CSV user import functionality is vulnerable to Cross-Site Request Forgery (CSRF).CVE-2022-252428.8In FileCloud before 21.3, file upload is not protected against Cross-Site Request Forgery (CSRF).CVE-2022-252436.5"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard cer CVE-2022-252446.5Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuratio CVE-2022-252455.3Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name.CVE-2022-252468.8Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Su CVE-2022-252479.8Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific