Dominic Griesel (AlCalzone), who maintains Z-Wave JS, merged two fixes on 23 October 2026 that limit incoming requests a device on the network could abuse. One could keep the controller's radio busy, the other could freeze the driver completely. Both landed after Z-Wave JS 15.31.2 from 22 October, so they will arrive in the next release and then in the Z-Wave JS app for Home Assistant and in Z-Wave JS UI.
Radio tests without limits
Z-Wave has a Powerlevel command class for checking link quality. One node asks another to send a series of test frames to a third node at a chosen power level and report how many got through. Until now Z-Wave JS accepted such a request from any node and with any values. A device could make the controller send up to 65,535 NOP test frames to any node ID, including one that does not exist, and could restart the test whenever it liked. All that time the controller's radio was busy.
After pull request #9374 the target has to be a known node other than the controller itself, the number of frames is capped at 1,000, and a new request is ignored while a test is still running. The 15.31.2 release already included a related change that rejects invalid statuses in the test report.
A frozen driver on S0
The second fix concerns S0, the older Z-Wave security scheme. Before every encrypted message the sender asks the receiver for a one-time number called a nonce. Z-Wave JS did not limit how many unanswered nonces it handed out. Once all 256 identifiers were in use, the function that generates a new nonce kept searching for a free one forever, and the driver froze. The pull request names a flood of S0 Nonce Get commands as the trigger, for example from several nodes or during inclusion, faster than old nonces expire.
Pull request #9375 caps the table of outstanding nonces at 128, as the Z-Wave specification SDS10865 sets out. When the table is full, the request for another nonce fails, and the existing code already handles that case.
Nothing to set up
Both changes protect the controller from a faulty or malicious device that sends these commands, and you only need to update once the release is out. They follow the fix from 22 October, which made Z-Wave JS ignore alarm reports that one node sent on behalf of another.