[GHSA-mq36-523m-x7vv] node-opcua missing nonce verification in UserNameIdentityToken authentication

[kgnio]

Updates

• Affected products
• Description

Comments
The affected version range is incomplete and the patched version is missing.

The nonce-verification fix was introduced in commit c6b05738682f5c8d70b1ea275c881f01a1cd9787. This commit adds validation that the trailing bytes of the decrypted UserNameIdentityToken password blob match the session's server nonce, directly addressing the vulnerability described by this advisory.

Version 2.165.2 is an existing release that predates the nonce-verification fix, while the fix commit is contained in v2.166.0.

This change therefore updates:

Affected versions:
<= 2.165.0 → < 2.166.0

Patched versions:
None → 2.166.0

The Description's affected-version line is updated to match the corrected structured metadata.

No changes are made to the title, CWE, CVSS, severity, references, or source code location.

References:

• Fix commit:
  node-opcua/node-opcua@c6b0573

• Comparison showing the fix commit is included in v2.166.0:
  node-opcua/node-opcua@c6b0573...v2.166.0

• v2.165.2 package metadata:
  https://github.com/node-opcua/node-opcua/blob/v2.165.2/packages/node-opcua/package.json

• v2.166.0 package metadata:
  https://github.com/node-opcua/node-opcua/blob/v2.166.0/packages/node-opcua/package.json

[github]

Hi there @erossignon! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory