Description
@anephenix/hub starts a setInterval polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never replies — which requires no authentication or special configuration — the interval and the pending request object are never cleaned up, even after the socket is closed.
Recommendation
Update the @anephenix/hub package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.2.16
- Patched version(s): 0.2.16
References
Could your website be exposed too?
SmartScanner can check your website for @anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host - CVE-2026-71319
- Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution - CVE-2026-34148
- websocket-driver: Resource limit bypass via message compression - CVE-2026-54490
- jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion - CVE-2026-52746
You might also like:
See something that needs correcting? Let us knowUpdated August 13, 2026