Advisories · Technology

node-opcua.

Every CVE that names node-opcua among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-95860 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions
- node-opcua
- Broken access control
- CWE-636
Not analysed yet 3 Nov 2026
CVE-2026-69200 CVE record

CVSS 3.7 Low

node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)
- node-opcua
- Prototype pollution
Not analysed yet 16 Sept 2026