Listen to this Post
CVE-2026-68904 is a high-severity vulnerability affecting node-opcua, the OPC UA implementation for TypeScript and Node.js. The vulnerability manifests as an uncontrolled resource consumption issue (CWE-400) where a combination of two bugs causes unlimited TCP socket accumulation in the FIN-WAIT-2 state during automatic reconnection cycles. The root cause involves a misclassification of a server response and an improper socket teardown procedure. When an OPC UA server’s clock is skewed relative to the client, the server may respond to the client’s periodic keep-alive requests with a `BadInvalidTimestamp` status code. The client’s `ClientSessionKeepAliveManager._ping_server()` method incorrectly treats this application-level status as a fatal network outage, triggering a full transport-level reconnection cycle on every keep-alive interval. This reconnection attempt initiates a new HEL/ACK handshake. When this handshake fails, the `ClientTCP_transport._on_ACK_response()` method calls `socket.end()` instead of socket.destroy(). The `socket.end()` call sends a TCP FIN packet but waits for the peer to close the connection, leaving the socket in a FIN-WAIT-2 state indefinitely if the peer does not respond. This behavior is common with industrial PLCs that may not properly acknowledge the close. The rapid reconnection cycle, driven by the misclassified timestamp error and exacerbated by the default `keepSessionAlive: true` configuration, causes a new socket to be leaked and stuck in FIN-WAIT-2 on every cycle. With a typical keep-alive interval of 3000 milliseconds, this leads to approximately 20 leaked sockets per minute or 1200 per hour, eventually exhausting file descriptors and memory, and resulting in a process or container crash due to an Out-Of-Memory (OOM) kill. The vulnerability affects node-opcua versions from 2.0.0 up to, but not including, 2.170.0, where it was officially patched.
DailyCVE Form:
Platform: node-opcua
Version: >=2.0.0 <2.170.0
Vulnerability: TCP Socket Leak
Severity: High (CVSS 7)
date: 2026-09-16
Prediction: Official patch in 2.170.0, but true fix in 2.172.0.
What Undercode Say:
Analytics
Monitoring for leaked sockets in the FIN-WAIT-2 state:
Count sockets in FIN-WAIT-2 state ss -antp | grep FIN-WAIT-2 | wc -l List all sockets in FIN-WAIT-2 with process details ss -antp state fin-wait-2 Monitor socket state changes over time watch -n 1 "ss -antp | grep FIN-WAIT-2 | wc -l"
Identifying the affected processes:
Find node process consuming file descriptors lsof -p <PID> | wc -l Check system-wide file descriptor limits cat /proc/sys/fs/file-max ulimit -n Monitor memory usage of the node process ps aux | grep node
Exploit: (Educational Purposes!)
This vulnerability is not a remote code execution flaw but a denial-of-service condition triggered by a specific environmental misconfiguration. The “exploit” is the natural behavior of the system under clock skew.
– Configure an OPC UA server with a clock skew of more than the server’s timestamp tolerance ahead of the client (e.g., 50 minutes ahead).
– Connect to this server using a node-opcua client with default settings (keepSessionAlive: true).
– The client’s keep-alive mechanism will receive `BadInvalidTimestamp` responses and incorrectly trigger full reconnections.
– Each reconnection cycle leaks a TCP socket in FIN-WAIT-2 state due to the `socket.end()` bug.
– Over time, the process accumulates thousands of leaked sockets (e.g., 11,476 sockets in a real-world incident), consuming memory and file descriptors until the system crashes.
Protection: from this CVE
- Upgrade: The official fix is available in node-opcua version 2.170.0, which replaces `socket.end()` with `socket.destroy()` and modifies the keep-alive manager to handle `BadInvalidTimestamp` without forcing a reconnection. However, the reporter notes that the true fix, addressing the protocol logic to prevent endless retry loops, is in version 2.172.0. Upgrading to 2.172.0 or later is recommended.
- Configuration: If upgrading is not immediately possible, setting `keepSessionAlive: false` in the client configuration will prevent the keep-alive manager from triggering the reconnection cycle. However, this disables an important feature for maintaining session health.
- Network Mitigation: Ensure OPC UA servers are configured with NTP or other time synchronization to prevent clock skew, which is the primary trigger for this vulnerability.
- Monitoring: Implement monitoring for sockets in FIN-WAIT-2 state and for abnormal file descriptor growth in Node.js processes to detect and mitigate the issue in real-time.
Impact:
Successful exploitation of this vulnerability leads to a denial-of-service condition. The uncontrolled accumulation of TCP sockets in the FIN-WAIT-2 state consumes system resources, specifically file descriptors and memory. This resource exhaustion eventually causes the Node.js process or its container to crash due to an Out-Of-Memory (OOM) kill. In a real-world scenario, this resulted in the crash of a network daemon and a total blackout for 40 production stations, demonstrating the severity of the cascading failure. The vulnerability has a high availability impact (A:H) while confidentiality and integrity impacts are low.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
