VulnerabilityPublished 07/24/2026

@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

Affects @anephenix/hubSource GCVE Database

CVSS 3.1 base score

7.5High

Patch: Available – fixed in 0.2.16

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, mitigate by limiting the number of concurrent WebSocket connections or implementing external rate limiting and connection timeouts to prevent resource exhaustion. Monitor for updates from the vendor regarding an official patch.

Affected software

Product	Affected	Fixed in
npm@anephenix/hub	Affected <0.2.16	Fixed in 0.2.16

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

@anephenix/hub before version 0.2.16 contains an unauthenticated denial-of-service vulnerability. The server starts a polling loop via setInterval for every incoming WebSocket connection to request a client ID via RPC. If the client never responds, these intervals and pending requests are never cleaned up, even after the socket closes. An attacker can open many WebSocket connections and ignore server RPC messages, causing unbounded accumulation of timers and heap objects. This leads to CPU and memory exhaustion, resulting in denial of service.

Summary

@anephenix/hub versions prior to 0.2.16 implement an RPC mechanism over WebSocket connections that requests a client ID by sending a 'get-client-id' action. For each connection, a setInterval timer polls for a matching RPC response every 10 ms. If the client never replies, the timer and the pending request remain indefinitely because there is no timeout or cleanup on socket close. This allows an unauthenticated attacker to open many connections and cause unbounded resource consumption (timers and heap objects), leading to CPU and memory exhaustion and denial of service.

Impact

An unauthenticated attacker can cause a denial-of-service condition by opening many WebSocket connections and ignoring the server's RPC requests. This causes the server to accumulate timers and memory objects indefinitely, exhausting CPU and memory resources. The vulnerability affects any network-reachable @anephenix/hub server running default configuration prior to version 0.2.16.

Weaknesses

CWE-400Uncontrolled Resource Consumption (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 07/25/2026, 23:52:27 UTC

Technical details

Weaknesses

References

Related threats