CVE-2022-21208

Katalog CVE

CVSS 7.5 · High EPSS 1,4%

Kerentanan Improper Validation of Specified Quantity in Input pada node-opcua project node-opcua. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.

Rincian

Terbit di NVD

23 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1284: Improper Validation of Specified Quantity in Input

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/node-opcua/node-opcua/commit/33ca3bab4ab781392a2f8d8f5a14de9a0aa0e410 patch · advisory pihak ketiga
• https://github.com/node-opcua/node-opcua/commit/dbcb5d5191118c22ee9c89332a94b94e6553d76b patch · advisory pihak ketiga
• https://github.com/node-opcua/node-opcua/pull/1149 patch · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988723 advisory pihak ketiga