node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS (CVE-2026-54156)

node-opcua contains a process-global nonce cache without an eviction policy, tracked in the g_alreadyUsedNonce object. Nonces are added on every OpenSecureChannelRequest and CreateSession request but never removed or expired. An unauthenticated attacker can exploit the CreateSession path, which requires no certificate, to accumulate nonce entries indefinitely. Despite limits on concurrent sessions, nonces persist after session expiry, causing heap growth and eventual exhaustion. Testing confirmed significant heap increase with thousands of nonces, projecting out-of-memory conditions under default Node.js heap limits. The suggested fix is to implement a TTL-based eviction policy for the nonce cache, expiring entries after the maximum session timeout or a fixed window.

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by exhausting the server's heap memory. This results in the node-opcua server process crashing, disrupting service availability. There is no impact on confidentiality or integrity. The CVSS score is 7.5 (High) reflecting the ease of remote exploitation and the denial of service impact.

A patch is available to address this vulnerability by adding a TTL-based eviction policy to the nonce cache (g_alreadyUsedNonce). Nonces should expire after the maximum session timeout or a reasonable fixed window, preventing unbounded memory growth. Users should upgrade to node-opcua version 2.166.0 or later where this fix is implemented.