CVE-2026-69200 node-opcua CVE debrief

Who should care

Defenders responsible for node-opcua and node-opcua-client deployments should assess the vulnerability and take necessary actions to prevent potential Object.prototype pollution. This includes verifying if their applications expose attacker-controlled event fields to fieldsToJson and updating node-opcua-client to version 2.145.0 or later. Additionally, defenders should review compensating controls for exposed systems and track exceptions, retest remediated

Why it matters

CVE-2026-69200 is a vulnerability in node-opcua that allows Object.prototype pollution, potentially leading to denial of service or application logic corruption. Defenders should verify if their applications are affected and update node-opcua-client to version 2.145.0 or later.

• Potential denial of service due to Object.prototype pollution
• Potential application logic corruption due to Object.prototype pollution
• Verification of applications exposing attacker-controlled event fields to fieldsToJson is necessary
• Updating node-opcua-client to version 2.145.0 or later is recommended

Technical summary

The internal fieldsToJson method in node-opcua-client allows unsanitized field names, potentially leading to Object.prototype pollution. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson, which may cause denial of service or application logic corruption. This vulnerability is fixed in node-opcua-client version 2.145.0. Defenders should prioritize verifying if their applications expose attacker-controlled event fields to fieldsToJson and assess the impact of potential Object.prototype pollution.

Defensive priority

Defenders should prioritize verifying if their applications expose attacker-controlled event fields to fieldsToJson and assess the impact of potential Object.prototype pollution.

Recommended defensive actions

• Verify if applications expose attacker-controlled event fields to fieldsToJson
• Assess the impact of potential Object.prototype pollution
• Update node-opcua-client to version 2.145.0 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, its impact, and the fixed version. However, additional information about potential exploitation or affected systems is limited. Defenders should verify if their applications expose attacker-controlled event fields to fieldsToJson and assess the impact of potential Object.prototype pollution with careful review of node-opcua-client version 2.145.0 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.