The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
{
"cna_assigner": "snyk",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24375.json"
}{
"extracted_events": [
{
"cpe": "cpe:2.3:a:node-opcua_project:node-opcua:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.74.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "3fd46ec156e7718a506be41f3916310b6bdd0407"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "7b5044b3f5866fbedc3efabd05e407352c07bd2f"
}
],
"source": "REFERENCES_COMMIT"
}
]
}