Skip to content
cve.newCreate a CVE report

node-opcua-server

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Behind the package

View on npm

Explore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.

pure nodejs OPCUA SDK - module server

Latest release2.187.27
Declared licenseMIT
Listed maintainerserossignon
Runtime dependencies51
Install-time scriptsNone declared
Integrity metadataRecorded by registry
Attestation metadataRecorded, not verified here
Registry deprecationNot marked deprecated
Direct dependencies of 2.187.27

Fetched 14/11/2026, 22:21:39 UTC · Original registry metadata

Release history

Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

critical9.1
CVE-2026-95860Package fixes recorded

node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

An unauthenticated (Anonymous) client can Write protected Variables and Call privileged Methods on any Node that lacks explicit per-node permissions.

Recorded fixes — node-opcua: 2.180.0; node-opcua-address-space: 2.180.0; 1 more packages. Check your release branch.

Public exploit reference

npm / node-opcuanpm / node-opcua-address-spacenpm / node-opcua-server
node-opcua-server npm
Affected range Recorded fix
From 2.42.0 before 2.180.0Semantic versions2.180.0

Version evidence: OSV · GHSA-xggf-m53x-jc3f

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.42.0"
        },
        {
          "fixed": "2.180.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}