CVE-2022-21208

The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.

• CWE-1284

• https://github.com/node-opcua/node-opcua/commit/33ca3bab4ab781392a2f8d8f5a14de9a0aa0e410Patch, Third Party Advisory
• https://github.com/node-opcua/node-opcua/commit/dbcb5d5191118c22ee9c89332a94b94e6553d76bPatch, Third Party Advisory
• https://github.com/node-opcua/node-opcua/pull/1149Patch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988723Third Party Advisory
• https://github.com/node-opcua/node-opcua/commit/33ca3bab4ab781392a2f8d8f5a14de9a0aa0e410Patch, Third Party Advisory
• https://github.com/node-opcua/node-opcua/commit/dbcb5d5191118c22ee9c89332a94b94e6553d76bPatch, Third Party Advisory
• https://github.com/node-opcua/node-opcua/pull/1149Patch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-NODEOPCUA-2988723Third Party Advisory

Published

Aug 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21202The affected product is vulnerable to an out-of-bounds read,…5.5
• CVE-2022-21203Improper permissions in the SafeNet Sentinel driver for Inte…7.8
• CVE-2022-21204Improper permissions for Intel(R) Quartus(R) Prime Pro Editi…7.8
• CVE-2022-21205Improper restriction of XML external entity reference in DSP…7.5
• CVE-2022-21206Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-21207Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-21209The affected product is vulnerable to an out-of-bounds read …7.8
• CVE-2022-2121OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL point…6.5
• CVE-2022-21210An SQL injection vulnerability exists in the AssetActions.as…8.8
• CVE-2022-21211This affects all versions of package posix. When invoking th…7.5
• CVE-2022-21212Improper input validation for some Intel(R) PROSet/Wireless …6.5
• CVE-2022-21213This affects all versions of package mout. The deepFillIn fu…7.5