Junglewise Threat Intelligence

anephenix @anephenix/hub DoS via WebSocket RPC resource exhaustion

Severity: high · CVSS 7.5 · Published 2026-07-24

Vendors: npm.

Executive brief

@anephenix/hub is a library used to manage WebSocket connections and communications. A flaw in how it handles new connections allows an attacker to crash the server by opening many connections and then remaining silent. This results in a denial-of-service (DoS) condition, making the service unavailable to legitimate users.

Technical details

The vulnerability is a resource exhaustion issue (DoS) caused by improper cleanup of RPC request waiters. When a new WebSocket connection is established, the server automatically issues a 'get-client-id' RPC request via `setInterval`. If the client does not respond, the `setInterval` timer and the associated request object in `this.requests` are never cleared, even if the WebSocket connection is closed. An attacker can exploit this by opening numerous connections and ignoring the server's messages, leading to linear accumulation of timers and heap objects. This eventually exhausts CPU and memory resources. The issue is fixed in version 0.2.16.

Affected products

  • anephenix @anephenix/hub <= 0.2.15

Timeline

  • 2026-07-23: advisory: GitHub Advisory published
  • 2026-07-23: patched: Version 0.2.16 released

References

Related threats