[GHSA-6wvw-vrw4-363w] node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

[kgnio]

Updates

• Affected products
• Description

Comments
The affected and patched version metadata appears to be inconsistent with the upstream fix history.
The advisory currently lists affected versions as <= 2.165.0 and the patched version as 2.168.0.
However, the upstream fix commit (b82c2939fe9c658de58da993f2798ec5481d7313) directly addresses the unbounded nonce cache by introducing TTL-based and maximum-size eviction.
This fix is included in v2.166.0. Intermediate 2.165.x releases prior to v2.166.0 also appear to remain affected because the fix is first included in v2.166.0.

This change updates:
Affected versions:
<= 2.165.0 → < 2.166.0
Patched versions:
2.168.0 → 2.166.0

References:

• Fix commit:
  node-opcua/node-opcua@b82c293

• Confirmation that the fix is included in v2.166.0:
  node-opcua/node-opcua@b82c293...v2.166.0

[github]

Hi there @erossignon! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[erossignon]

Correct.