CVE-2026-95860

Name of the Vulnerable Software and Affected Versions node-opcua versions 2.42.0 through 2.179.0

Description Namespace-level access control configured via setDefaultRolePermissions is not honored by the runtime enforcement path for nodes lacking explicit per-node RolePermissions. The SessionContext.getApplicableRolePermissions function reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and this null result is treated permissively. This allows an anonymous network client to write variables with CurrentWrite access or call bound methods when a restrictive namespace default was configured and relied upon for inheritance.

Recommendations Update to version 2.180.0.