cve.bz

CVE-2022-21208

7.5 highEPSS 1.5%

High (7.5) in node-opcua project node-opcua. EPSS 1.5% chance of exploitation in the next 30 days. Fixed in node-opcua 2.74.0.

The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWE
CWE-1284
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-4hr4-pjjh-2q2wnpmnode-opcua<2.74.02.74.0

References

Check your stackJSON