Executive brief
@anephenix/hub is a Node.js WebSocket server library used to facilitate real-time client communication. An unauthenticated attacker can open many WebSocket connections without responding to server RPC messages, causing the server to accumulate uncleaned timers and memory objects indefinitely. This exhausts the server's CPU and memory, making it unavailable to legitimate users.
Technical details
The vulnerability is a resource exhaustion (DoS) in the WebSocket connection handler. When a client connects, the server initiates an RPC request to fetch a client ID via setInterval polling (every 10 ms). If the client never replies, the polling interval and pending request object are never cleaned up—even after the socket closes—because the cleanup logic only triggers on a successful response and there is no timeout handler or socket-close cleanup. An unauthenticated attacker on the network can exploit this by opening many WebSocket connections and never responding, forcing the server to accumulate one interval timer and heap object per connection indefinitely. No authentication, special configuration, or protocol knowledge is required. Patch available in version 0.2.16.
Affected products
- anephenix hub <= 0.2.15
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched: Fixed in version 0.2.16