---
id: "CVE-2026-95860"
kind: "vulnerability"
aliases: ["CVE-2026-95860"]
title: "node-opcua: namespace access defaults ignored, anonymous clients can write variables"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["industrial", "node-opcua", "nodejs", "opc-ua", "package", "typescript"]
not_affected_if: ["explicit-per-node-permissions", "no-namespace-default-permissions", "version-2.180.0-or-later"]
published_at: "2026-11-03T21:17:45+00:00"
first_seen_at: "2026-11-03T21:19:31+00:00"
updated_at: "2026-11-03T21:20:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95860", "first_seen_at": "2026-11-03T21:19:31+00:00"}]
---

# node-opcua: namespace access defaults ignored, anonymous clients can write variables

node-opcua, an OPC UA server library for Node.js and TypeScript, fails to apply namespace-level default role permissions to nodes without explicit per-node permissions. An anonymous network client can write variables marked CurrentWrite or call bound methods that the operator meant to restrict.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed node-opcua version in the project lockfile or with `npm ls node-opcua`, looking for versions from `2.42.0` up to before `2.180.0`.
- Search the server code for calls to `setDefaultRolePermissions` to see whether a restrictive namespace default is relied on for inheritance.

## Fix

- node-opcua: move to `2.180.0` or later.

## Timeline

- 2026-11-03T21:19:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95860

## Documents

- [advisory] Vendor advisory: github.com https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f
- [fix] Patch: github.com https://github.com/node-opcua/node-opcua/commit/0261e873900800983c622e01120f484dc6063698
- [fix] Release notes: github.com https://github.com/node-opcua/node-opcua/releases/tag/v2.180.0

## From the sources

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_