CVE-2026-68904: node-opcua-transport TCP Socket Leak via Keepalive Reconnection Loop

// Trigger: connect to an OPC UA server with clock skew > server timestamp tolerance
// using default keepSessionAlive: true. Monitor socket accumulation:
//
//   ss -antp | grep FIN-WAIT-2 | wc -l
//
// Watch the count grow by one every keepAliveInterval ms.

import { OPCUAClient } from "node-opcua";

const client = OPCUAClient.create({
  keepSessionAlive: true,    // default: true -- enables the ping loop
  keepAliveInterval: 3000,   // default: triggers reconnect every 3 s
  securityMode: "None",
  securityPolicy: "None",
  endpointMustExist: false,
});

// Target: OPC UA server whose clock is >~1 minute ahead of the client.
// The server will return BadInvalidTimestamp (0x80230000) on each Read.
// The keepalive manager misclassifies this as a network failure,
// calls terminateConnection() -> forceConnectionBreak() on every tick,
// and _on_ACK_response() leaks a FIN-WAIT-2 socket on every reconnect attempt.
await client.connect("opc.tcp://<skewed-plc-or-server>:4840");
const session = await client.createSession();
// Leave running. FIN-WAIT-2 count climbs continuously.