{"action":"Upgrade node-opcua to 2.166.0 or later.","affected":[{"fixed":"2.166.0","introduced":"0"}],"component":"node-opcua","cve_ids":["CVE-2026-54156"],"ecosystem":"npm","epss":0.00784,"exploited":false,"fixed_versions":["2.166.0"],"ghsa_id":"GHSA-6wvw-vrw4-363w","id":"tcs_01M5KF86410W1SXYFN4BC6RP2M","modified_at":"2026-08-27T19:15:07.090081514Z","published_at":"2026-08-20T18:35:41Z","references":["https://osv.dev/vulnerability/GHSA-6wvw-vrw4-363w","https://github.com/node-opcua/node-opcua/security/advisories/GHSA-6wvw-vrw4-363w","https://github.com/node-opcua/node-opcua/commit/b82c2939fe9c658de58da993f2798ec5481d7313","https://github.com/node-opcua/node-opcua","https://github.com/node-opcua/node-opcua/releases/tag/v2.166.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-6wvw-vrw4-363w","url":"https://osv.dev/vulnerability/GHSA-6wvw-vrw4-363w"}],"summary":"node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS"}