CVE-2026-73561

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73561", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-12T20:53:46.380Z", "datePublished": "2026-08-13T17:24:34.761Z", "dateUpdated": "2026-08-18T01:27:12.169Z"}, "containers": {"cna": {"title": "Hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78"}, {"name": "https://github.com/anephenix/hub/commit/931576db3cdbf4f1583bd2c3c8759c4f4e032ab3", "tags": ["x_refsource_MISC"], "url": "https://github.com/anephenix/hub/commit/931576db3cdbf4f1583bd2c3c8759c4f4e032ab3"}, {"name": "https://github.com/anephenix/hub/tree/v0.2.16", "tags": ["x_refsource_MISC"], "url": "https://github.com/anephenix/hub/tree/v0.2.16"}], "affected": [{"vendor": "anephenix", "product": "hub", "versions": [{"version": "< 0.2.16", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T17:24:34.761Z"}, "descriptions": [{"lang": "en", "value": "Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated because the socket close path does not cancel them. Repeated connections therefore cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. This issue is fixed in version 0.2.16."}], "source": {"advisory": "GHSA-g5vv-q72c-7j78", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-18T01:26:22.551405Z", "id": "CVE-2026-73561", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T01:27:12.169Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73561", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T01:26:22.551405Z"}}}], "references": [{"url": "https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T01:27:03.306Z"}}], "cna": {"title": "Hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion", "source": {"advisory": "GHSA-g5vv-q72c-7j78", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "anephenix", "product": "hub", "versions": [{"status": "affected", "version": "< 0.2.16"}]}], "references": [{"url": "https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78", "name": "https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/anephenix/hub/commit/931576db3cdbf4f1583bd2c3c8759c4f4e032ab3", "name": "https://github.com/anephenix/hub/commit/931576db3cdbf4f1583bd2c3c8759c4f4e032ab3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/anephenix/hub/tree/v0.2.16", "name": "https://github.com/anephenix/hub/tree/v0.2.16", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated because the socket close path does not cancel them. Repeated connections therefore cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. This issue is fixed in version 0.2.16."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T17:24:34.761Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73561", "state": "PUBLISHED", "dateUpdated": "2026-08-18T01:27:12.169Z", "dateReserved": "2026-08-12T20:53:46.380Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-13T17:24:34.761Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hub", "vendor": "anephenix", "versions": [{"status": "affected", "version": "< 0.2.16"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated because the socket close path does not cancel them. Repeated connections therefore cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. This issue is fixed in version 0.2.16."}, {"lang": "es", "value": "Hub es un servidor y cliente WebSocket de Node.js con caracter\u00edsticas a\u00f1adidas. Antes de la versi\u00f3n 0.2.16, cada conexi\u00f3n WebSocket entrante no autenticada desencadena loadDefaultConnectionEventListeners para llamar a requestClientId, que llama a rpc.send para la acci\u00f3n get-client-id y empuja una solicitud a RPC.requests. La funci\u00f3n RPC.waitForReply inicia un bucle de sondeo setInterval cada 10 milisegundos que se borra solo despu\u00e9s de una respuesta coincidente; si el cliente permanece en silencio y se cierra, el temporizador y la solicitud pendiente permanecen asignados porque la ruta de cierre del socket no los cancela. Las conexiones repetidas, por lo tanto, causan temporizadores ilimitados y entradas de pila, agotando la CPU y la memoria y haciendo que el servidor no est\u00e9 disponible. Este problema est\u00e1 solucionado en la versi\u00f3n 0.2.16."}], "id": "CVE-2026-73561", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73561", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-18T01:26:22.551405Z", "version": "2.0.3"}}]}, "published": "2026-08-13T18:18:18.490", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/anephenix/hub/commit/931576db3cdbf4f1583bd2c3c8759c4f4e032ab3"}, {"source": "security-advisories@github.com", "url": "https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78"}, {"source": "security-advisories@github.com", "url": "https://github.com/anephenix/hub/tree/v0.2.16"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.2.16)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "hub", "source": "cna", "vendor": "anephenix"}, "product": "hub", "vendor": "anephenix"}], "created": "2026-08-13T18:45:04.406928+00:00", "updated": "2026-08-14T09:31:01.950943+00:00", "vendors": ["anephenix", "anephenix$PRODUCT$hub"]}