THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-r2pf-9cw4-5j65 (high) — node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

[GHSA] GHSA-r2pf-9cw4-5j65 (high) — node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

medgithub_advisoriesPublished 2026-09-16

GHSA-r2pf-9cw4-5j65 Severity: high CVE: CVE-2026-68904

node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

SUMMARY ------- A combination of bugs in node-opcua causes unlimited TCP socket accumulation (FIN-WAIT-2 state) during automatic reconnection, leading to memory exhaustion and eventual container/process crash (OOM kill). The issue is triggered by

Indicators of compromise

CVE-2026-68904cve
velluso.marco64@gmail.comemail

Original source: https://github.com/advisories/GHSA-r2pf-9cw4-5j65