critical vulnerability

node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

Fix availableCritical · CVSS 9.1EPSS 0.60%

Published Nov 10, 2026 · updated Nov 10, 2026

What to do

Upgrade to a fixed version: node-opcua 2.180.0, node-opcua-address-space 2.180.0, node-opcua-server 2.180.0.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmnode-opcua92,316 downloads/week

Vulnerable versions: >= 2.42.0, < 2.180.0
Fixed in: 2.180.0

Check your project: npm ls node-opcua --all

Is node-opcua@2.180.0 safe to install? See the upgrade verdict →

npmnode-opcua-address-space129,948 downloads/week

Vulnerable versions: >= 2.42.0, < 2.180.0
Fixed in: 2.180.0

Check your project: npm ls node-opcua-address-space --all

Is node-opcua-address-space@2.180.0 safe to install? See the upgrade verdict →

npmnode-opcua-server129,646 downloads/week

Vulnerable versions: >= 2.42.0, < 2.180.0
Fixed in: 2.180.0

Check your project: npm ls node-opcua-server --all

Is node-opcua-server@2.180.0 safe to install? See the upgrade verdict →

What changed

Nov 10, 2026
Published in the GitHub Advisory Database as critical.

Sources

CWE-285 Improper Authorization · CWE-636 Not Failing Securely · CWE-863 Incorrect Authorization · CWE-1188 Initialization of a Resource with an Insecure Default

← All critical vulnerabilities