Z-Wave JS, the driver behind Home Assistant's Z-Wave integration and Z-Wave JS UI, has fixed a way for one device on the network to raise alarms on behalf of another. The change by Dominic Griesel (AlCalzone), the project's lead developer, was merged into the main branch on 22 October 2026.
What was wrong
The problem sat in how the driver read Alarm Sensor Reports. These reports carry a field with a source node ID, meant for the case where one device forwards an alarm from another. Z-Wave JS used that field to decide which device the alarm belonged to, instead of looking at the device that actually sent the message.
That meant any node could send a report with another node's ID in the field and have the alarm show up as if it came from that node. According to the pull request, this worked even from a device included without security, so it bypassed the security class of the device being impersonated. A securely included smoke or water sensor offers little protection if an unsecured device can trigger alarms in its name.
What changes
The driver now always attributes a report to the device that sent it. If the source node ID in the report is neither 0 nor the sender's own ID, the report is dropped and a message goes to the log.
There is a trade-off. Legitimately forwarded Alarm Sensor Reports are dropped too, because Z-Wave JS has no way to verify that the forwarding device is allowed to speak for another one. The fix only touches the Alarm Sensor command class.
When it arrives
The fix is not in Z-Wave JS 15.31.2, which was released a few hours before the merge on 22 October. It will come with the next release, and Home Assistant users will get it once the Z-Wave JS server or Z-Wave JS UI they run picks up that driver version.