@anephenix/hub versions prior to 0.2.16 implement an RPC mechanism over WebSocket connections that requests a client ID by sending a 'get-client-id' action. For each connection, a setInterval timer polls for a matching RPC response every 10 ms. If the client never replies, the timer and the pending request remain indefinitely because there is no timeout or cleanup on socket close. This allows an unauthenticated attacker to open many connections and cause unbounded resource consumption (timers and heap objects), leading to CPU and memory exhaustion and denial of service.

An unauthenticated attacker can cause a denial-of-service condition by opening many WebSocket connections and ignoring the server's RPC requests. This causes the server to accumulate timers and memory objects indefinitely, exhausting CPU and memory resources. The vulnerability affects any network-reachable @anephenix/hub server running default configuration prior to version 0.2.16.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, mitigate by limiting the number of concurrent WebSocket connections or implementing external rate limiting and connection timeouts to prevent resource exhaustion. Monitor for updates from the vendor regarding an official patch.