CVE-2026-69200 Overview
CVE-2026-69200 is a prototype pollution vulnerability in node-opcua, an OPC UA implementation for TypeScript and Node.js. Versions of node-opcua-client prior to 2.145.0 contain a flaw in the internal fieldsToJson method located in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts. The method assigns unsanitized field names directly and permits a __proto__.pollutedKey path to modify Object.prototype. Exploitation requires an application to expose attacker-controlled event fields to fieldsToJson. The issue is fixed in node-opcua-client version 2.145.0.
Critical Impact
Successful exploitation can lead to denial of service or application logic corruption through pollution of Object.prototype.
Affected Products
- node-opcua-client versions prior to 2.145.0
- Applications using node-opcua that pass attacker-controlled event fields to fieldsToJson
- Node.js and TypeScript projects consuming the affected package
Discovery Timeline
- 2026-09-16 - CVE-2026-69200 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-69200
Vulnerability Analysis
The vulnerability is a prototype pollution flaw classified under [CWE-1321] (Improperly Controlled Modification of Object Prototype Attributes). The affected fieldsToJson method in client_alarm.ts iterates over event field names and assigns them directly onto a target object without sanitization. When a field name uses the reserved __proto__ key followed by a nested property, the assignment traverses to Object.prototype and mutates it. This mutation propagates to every object in the running Node.js process.
Attackers can leverage this to inject properties that alter application control flow, override default values, or trigger runtime errors. The practical impact depends on how the host application consumes objects after the pollution occurs. Exploitation over the network requires the application to forward attacker-influenced OPC UA event fields into the vulnerable method, which raises attack complexity.
Root Cause
The root cause is unsafe property assignment in the internal fieldsToJson method. The method treats incoming field names as trusted keys and does not filter reserved prototype paths such as __proto__, constructor, or prototype. This design allows a __proto__.pollutedKey field name to reach Object.prototype during JSON construction.
Attack Vector
Exploitation requires a network-adjacent OPC UA server or intermediary capable of injecting crafted event field names into an application that uses the vulnerable client. The application must pass those fields into fieldsToJson. The attacker does not need authentication or user interaction, but the required exposure of fieldsToJson to untrusted input increases attack complexity.
The vulnerability mechanism is described in the GitHub Security Advisory GHSA-cv5q-7543-48q4. No verified proof-of-concept code is published in the referenced advisory.
Detection Methods for CVE-2026-69200
Indicators of Compromise
- Presence of node-opcua-client versions prior to 2.145.0 in package.json or package-lock.json
- OPC UA event payloads containing field names with __proto__, constructor, or prototype substrings
- Unexpected properties appearing on generic objects at runtime in Node.js processes consuming OPC UA events
Detection Strategies
- Perform software composition analysis (SCA) across Node.js projects to enumerate installed node-opcua-client versions
- Instrument application logging to record raw OPC UA event field names before they reach fieldsToJson
- Add runtime assertions that flag mutations to Object.prototype during process execution in development and staging
Monitoring Recommendations
- Alert on OPC UA client processes exhibiting unexpected exceptions, memory growth, or logic anomalies after receiving remote events
- Track dependency manifests in CI/CD pipelines and fail builds that pin vulnerable node-opcua-client versions
- Capture and review OPC UA event traffic for field names containing prototype-related keywords
How to Mitigate CVE-2026-69200
Immediate Actions Required
- Upgrade node-opcua-client to version 2.145.0 or later across all affected projects
- Audit application code paths that forward OPC UA event fields into fieldsToJson or similar handlers
- Restrict OPC UA server trust boundaries so untrusted endpoints cannot inject arbitrary event field names
Patch Information
The vulnerability is fixed in node-opcua-client version 2.145.0. Refer to the GitHub Security Advisory GHSA-cv5q-7543-48q4 for advisory details and remediation guidance.
Workarounds
- Sanitize incoming event field names by rejecting keys equal to __proto__, constructor, or prototype before passing data to the client
- Use Object.create(null) for accumulator objects in application code that processes OPC UA fields
- Freeze Object.prototype at process startup with Object.freeze(Object.prototype) to block runtime pollution where compatible with application dependencies
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
