{"id":"CVE-2026-73561","sourceIdentifier":"security-advisories@github.com","published":"2026-08-13T18:18:18.490","lastModified":"2026-10-24T15:10:00.190","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated because the socket close path does not cancel them. Repeated connections therefore cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. This issue is fixed in version 0.2.16."},{"lang":"es","value":"Hub es un servidor y cliente WebSocket de Node.js con características añadidas. Antes de la versión 0.2.16, cada conexión WebSocket entrante no autenticada desencadena loadDefaultConnectionEventListeners para llamar a requestClientId, que llama a rpc.send para la acción get-client-id y empuja una solicitud a RPC.requests. La función RPC.waitForReply inicia un bucle de sondeo setInterval cada 10 milisegundos que se borra solo después de una respuesta coincidente; si el cliente permanece en silencio y se cierra, el temporizador y la solicitud pendiente permanecen asignados porque la ruta de cierre del socket no los cancela. Las conexiones repetidas, por lo tanto, causan temporizadores ilimitados y entradas de pila, agotando la CPU y la memoria y haciendo que el servidor no esté disponible. Este problema está solucionado en la versión 0.2.16."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"anephenix","product":"hub","versions":[{"version":"< 0.2.16","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T01:26:22.551405Z","id":"CVE-2026-73561","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/anephenix/hub/commit/931576db3cdbf4f1583bd2c3c8759c4f4e032ab3","source":"security-advisories@github.com"},{"url":"https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78","source":"security-advisories@github.com"},{"url":"https://github.com/anephenix/hub/tree/v0.2.16","source":"security-advisories@github.com"},{"url":"https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}