Vulnerability · Published Aug 13, 2026 · Assigned by GitHub_M

CVE-2026-73561Hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

High 7.5

In plain English

A high-severity uncontrolled resource consumption in hub from anephenix. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 50.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated because the socket close path does not cancel them. Repeated connections therefore cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. This issue is fixed in version 0.2.16.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@anephenix/hub	0.2.16	GHSA-g5vv-q72c-7j78

Affected products (as reported)

Vendor	Product	Versions
anephenix	hub	< 0.2.16

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78 x_refsource_CONFIRM
https://github.com/anephenix/hub/commit/931576db3cdbf4f1583bd2c3c8759c4f4e032ab3 x_refsource_MISC
https://github.com/anephenix/hub/tree/v0.2.16 x_refsource_MISC