Low
node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)
Type: advisorySources: OSV
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption. This vulnerability is fixed in 2.145.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-69200
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 09:54 UTC · Revision 1
Source evidence
node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)
core-osv · Original sourcePublished 16 Sept 2026, 16:15 UTC
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption. This vulnerability is fixed in 2.145.0.
osv:CVE-2026-69200
Complete source record
{
"id": "facdca5c0d972211c5bacd3080272e2264bed2e24d600bb88cf6666fc6dd3ee2",
"url": "https://osv.dev/vulnerability/CVE-2026-69200",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)",
"summary": "node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly assigns unsanitized field names and allows a __proto__.pollutedKey path to modify Object.prototype. Successful exploitation requires an application to expose attacker-controlled event fields to fieldsToJson and may cause denial of service or application logic corruption. This vulnerability is fixed in 2.145.0.",
"evidence": "osv:CVE-2026-69200",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-69200",
"aliases": [
"CVE-2026-69200",
"GHSA-cv5q-7543-48q4"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/node-opcua/node-opcua",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "e2efb3b0b420f04e3cb54ce7b360a3499e135c8b"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.145.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.145.0"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"v2.144.0",
"v2.143.0",
"v2.142.0",
"v2.141.0",
"v2.140.0",
"v2.139.0",
"v2.138.1",
"v2.138.0",
"v2.137.0",
"v2.136.0",
"v2.135.0",
"v2.134.0",
"v2.133.0",
"v2.132.0",
"v2.131.0",
"v2.130.0",
"v2.129.0",
"v2.128.0",
"v2.127.1",
"v2.127.0",
"v2.126.0",
"v2.125.0",
"v2.124.0",
"v2.123.0",
"v2.122.0",
"v2.121.0",
"v2.120.0",
"v2.119.2",
"v2.119.1",
"v2.119.0",
"v2.113.0",
"v2.118.0",
"v2.117.0",
"v2.116.0",
"v2.115.0",
"v2.114.0",
"v2.112.0",
"v2.111.0",
"v2.110.0",
"v2.109.0",
"v2.108.0",
"v2.107.0",
"v2.106.0",
"v2.105.1",
"v2.105.0",
"v2.104.0",
"v2.103.0",
"v2.102.0",
"v2.101.0",
"v2.100.0",
"v2.99.1",
"v2.99.0",
"v2.98.2",
"v2.98.1",
"v2.98.0",
"v2.97.0",
"v2.96.0",
"v2.95.0",
"v2.94.0",
"v2.93.0",
"v2.92.0",
"v2.91.1",
"v2.91.0",
"v2.90.1",
"v2.90.0",
"v2.89.0",
"v2.88.0",
"v2.87.0",
"v2.86.1",
"v2.86.0",
"v2.85.0",
"v2.84.0",
"v2.83.0",
"v2.82.0",
"v2.81.0",
"v2.80.1",
"v2.80.0",
"v2.79.1",
"v2.79.0",
"v2.78.0",
"v2.77.0",
"v2.76.2",
"v2.76.1",
"v2.76.0",
"v2.75.0",
"v2.74.0",
"v2.73.1",
"v2.73.0",
"v2.72.2",
"v2.72.1",
"v2.72.0",
"v2.71.0",
"v2.70.3",
"v2.70.2",
"v2.70.1",
"v2.70.0",
"v2.69.1",
"v2.69.0",
"v2.67.0",
"v2.68.1",
"v2.68.0",
"v2.66.3",
"v2.66.2",
"v2.66.1",
"v2.66.0",
"v2.65.1",
"v2.65.0",
"v2.64.1",
"v2.64.0",
"v2.63.2",
"v2.63.1",
"v2.63.0",
"v2.62.7",
"v2.62.6",
"v2.62.5",
"v2.62.4",
"v2.62.3",
"v2.62.2",
"v2.62.1",
"v2.62.0",
"v2.61.0",
"v2.60.2",
"v2.60.1",
"v2.60.0",
"v2.59.1",
"v2.59.0",
"v2.58.0",
"v2.57.0",
"v2.56.3",
"v2.56.2",
"v2.56.1",
"v2.56.0",
"v2.55.0",
"v2.52.0",
"v2.51.0",
"v2.50.0",
"v2.49.0",
"v2.47.0",
"v2.46.0",
"v2.45.0",
"v2.44.0",
"v2.43.0",
"v2.42.2",
"v2.42.1",
"v2.42.0",
"v2.41.1",
"v2.41.0",
"v2.40.0",
"v2.37.0",
"v2.36.3",
"v2.36.2",
"v2.36.1",
"v2.36.0",
"v2.35.0",
"v2.34.0",
"v2.33.0",
"v2.32.0",
"v2.31.0",
"v2.30.0",
"v2.29.0",
"v2.28.3",
"v2.28.2",
"v2.28.1",
"v2.28.0",
"v2.27.1",
"v2.27.0",
"v2.26.0",
"v2.25.0",
"v2.24.1",
"v2.24.0",
"v2.23.0",
"v2.22.0",
"v2.21.0",
"v2.20.0",
"v2.19.0",
"v2.18.0",
"v2.17.0",
"v2.16.0",
"v2.15.0",
"v2.14.0",
"v2.13.0",
"v2.12.0",
"v2.11.0",
"v2.10.0",
"v2.9.1",
"v2.9.0",
"v2.8.1",
"v2.8.0",
"v2.7.0",
"v2.6.7",
"v2.6.6",
"v2.6.5",
"v2.6.4",
"v2.6.3",
"v2.6.2",
"v2.6.1",
"v2.6.0-alpha.7",
"v2.6.0-alpha.6",
"v2.6.0-alpha.1",
"v2.6.0-alpha.0",
"v2.5.12",
"v2.5.11",
"v2.5.10",
"v2.5.9",
"v2.5.8",
"v2.5.7",
"v2.5.6",
"v2.5.5",
"v2.5.4",
"v2.5.3",
"v2.5.2",
"v2.5.1",
"v2.5.0-alpha.15",
"v2.5.0-alpha.14",
"v2.5.0-alpha.13",
"v2.5.0-alpha.12",
"v2.5.0-alpha.11",
"v2.5.0-alpha.10",
"v2.5.0-alpha.9",
"v2.5.0-alpha.8",
"v2.5.0-alpha.7",
"v2.5.0-alpha.6",
"v2.5.0-alpha.5",
"v2.5.0-alpha.4",
"v2.5.0-alpha.3",
"v2.5.0-alpha.2",
"v2.5.0-alpha.1",
"v2.5.0-alpha.0",
"v2.4.4",
"v2.4.3",
"v2.4.2",
"v2.4.1",
"v2.4.0",
"v2.3.1",
"v2.3.0",
"v2.2.0",
"v2.1.9",
"v2.1.8",
"v2.1.7",
"v2.1.6",
"v2.1.5",
"v2.1.2",
"v2.1.1",
"v2.1.0",
"v2.0.1",
"v2.0.0",
"v2.0.0-alpha.33",
"v2.0.0-alpha.32",
"v2.0.0-alpha.31",
"v2.0.0-alpha.30",
"v2.0.0-alpha.29",
"v2.0.0-alpha.28",
"v2.0.0-alpha.27",
"v2.0.0-alpha.26",
"v2.0.0-alpha.25",
"v2.0.0-alpha.24",
"v2.0.0-alpha.23",
"v2.0.0-alpha.22",
"v2.0.0-alpha.21",
"v2.0.0-alpha.20",
"v2.0.0-alpha.19",
"v2.0.0-alpha.18",
"v2.0.0-alpha.17",
"v2.0.0-alpha.16",
"v2.0.0-alpha.15",
"v2.0.0-alpha.14",
"v2.0.0-alpha.13",
"v2.0.0-alpha.11",
"v2.0.0-alpha.10",
"v2.0.0-alpha.9",
"v2.0.0-alpha.8",
"v2.0.0-alpha.7",
"v2.0.0-alpha.6",
"v2.0.0-alpha.5",
"v2.0.0-alpha.4",
"v2.0.0-alpha.0",
"v0.4.5",
"v0.4.4",
"v0.4.3",
"v0.4.2",
"v0.4.1",
"v0.4.0",
"v0.3.0",
"v0.2.3",
"v0.2.2",
"v0.2.1",
"v0.2.0",
"V0.2.0",
"v0.1.1-0",
"v0.1.0-13",
"v0.1.0-12",
"v0.1.0-11",
"v0.1.0-10",
"v0.1.0-9",
"v0.1.0-8",
"v0.1.0-7",
"v0.1.0-6",
"v0.1.0-5",
"v0.1.0-4",
"v0.0.65",
"v0.0.64",
"v0.0.61",
"v0.0.60",
"v0.0.59",
"v0.0.58",
"v0.0.57",
"v0.0.56b",
"v0.0.56",
"v0.0.55",
"v0.0.54",
"v0.0.53",
"v.0.0.53",
"v0.0.52",
"v0.0.51",
"v0.0.50",
"v0.0.49",
"v0.0.48",
"v0.0.47",
"v0.0.46",
"v0.0.45",
"0.0.45",
"v0.0.42",
"v0.0.41",
"v0.0.40",
"v0.0.39",
"v0.0.38",
"v0.0.37",
"v0.0.35",
"v0.0.34",
"v0.0.24",
"v0.0.23",
"v0.0.22",
"v0.0.21",
"v0.0.20",
"v0.0.19",
"v0.0.14",
"v0.0.11",
"0.0.8",
"0.0.7",
"v0.0.5",
"v0.0.4",
"v0.0.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69200.json"
}
}
],
"modified": "2026-10-28T02:30:27.645463795Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69200.json",
"https://github.com/node-opcua/node-opcua/security/advisories/GHSA-cv5q-7543-48q4",
"https://nvd.nist.gov/vuln/detail/CVE-2026-69200"
],
"provider_metadata": {
"cwe_ids": [
"CWE-1321"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69200.json"
}
},
"related_cves": [
{
"value": "CVE-2026-69200",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 494338,
"published_at": "2026-09-16T16:15:58.656+00:00"
}