CVE-2026-73561
Received Received - Intake

Memory Leak in Hub WebSocket Server

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated because the socket close path does not cancel them. Repeated connections therefore cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. This issue is fixed in version 0.2.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73561
EUVD
EUVD-2026-58175

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
anephenix hub to 0.2.16 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a resource exhaustion vulnerability in a Node.js WebSocket server called Hub. When an unauthenticated client connects and ignores the server's RPC messages, the server starts timers and stores pending requests that never get cleaned up even after the client disconnects. Repeated connections cause these timers and memory allocations to grow without bound, eventually consuming all CPU and memory resources and making the server unavailable.

Detection Guidance

Monitor for excessive WebSocket connections or high CPU/memory usage on the server running @anephenix/hub versions 0.2.15 or earlier. Check for pending RPC requests in logs or via process inspection tools like ps or top.

Impact Analysis

An attacker can exploit this by opening many WebSocket connections and ignoring server messages. This causes the server to run out of memory and CPU, leading to slowdowns or complete crashes. Services relying on this server would become unavailable, disrupting normal operations.

Mitigation Strategies
  • Upgrade to @anephenix/hub version 0.2.16 or later to apply the fix for proper RPC request cleanup.
  • Restart the affected service to clear any accumulated pending RPC requests and timers.
  • Implement rate limiting or authentication for WebSocket connections to reduce unauthenticated connection attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73561. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart