Threats tagged 'ghsa-xggf-m53x-jc3f'

A critical vulnerability in node-opcua allows unauthenticated (Anonymous) clients to write protected variables and call privileged methods on nodes lacking explicit per-node permissions. This occurs because the server incorrectly grants all permissions when the namespace default role permissions are unset or null, violating OPC UA's default-deny security model. The flaw arises from a fail-open authorization logic and a disconnect between configuration and runtime enforcement, causing namespace default permissions to be ignored. This affects node-opcua versions from 2.42.0 up to but not including 2.180.0. A fix is available in version 2.180.0.