@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

Description

@anephenix/hub starts a setInterval polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never replies — which requires no authentication or special configuration — the interval and the pending request object are never cleaned up, even after the socket is closed.

Recommendation

Update the @anephenix/hub package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2.16
• Patched version(s): 0.2.16

References

• GHSA-g5vv-q72c-7j78
• CVE-2026-73561
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host - CVE-2026-71319
• Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution - CVE-2026-34148
• websocket-driver: Resource limit bypass via message compression - CVE-2026-54490
• jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion - CVE-2026-52746

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@anephenix/hub