CVE-2026-69200

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption. This vulnerability is fixed in 2.145.0.

• CWE-1321

• https://github.com/node-opcua/node-opcua/security/advisories/GHSA-cv5q-7543-48q4
• https://github.com/node-opcua/node-opcua/security/advisories/GHSA-cv5q-7543-48q4

Published

Sep 16, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6919Use after free in DevTools in Google Chrome prior to 147.0.7…9.6
• CVE-2026-69190Graylog is a free and open log management platform. From 6.3…6.3
• CVE-2026-69192ip-address is a library for parsing and manipulating IPv4 an…7.7
• CVE-2026-69197Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.…8.7
• CVE-2026-69198ip-address is a library for parsing and manipulating IPv4 an…6.9
• CVE-2026-6920Out of bounds read in GPU in Google Chrome on Android prior …9.6
• CVE-2026-69201Http4s is a Scala interface for HTTP services. Prior to 0.23…5.9
• CVE-2026-69202Http4s is a Scala interface for HTTP services. Prior to 0.23…7.5
• CVE-2026-69203Http4s is a Scala interface for HTTP services. Prior to 0.23…7.5
• CVE-2026-69204Http4s is a Scala interface for HTTP services. Prior to 0.23…9.2
• CVE-2026-69205Http4s is a Scala interface for HTTP services. Prior to 0.23…8.7
• CVE-2026-69206Http4s is a Scala interface for HTTP services. Prior to 0.23…5.9