Description

Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated because the socket close path does not cancel them. Repeated connections therefore cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. This issue is fixed in version 0.2.16.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T18:18:18.490Z",
  "pubdate": "2026-08-13T18:18:18.490Z",
  "executiveSummary": "A denial of service vulnerability exists in the Hub Node.js WebSocket server prior to version 0.2.16.\nThe vulnerability allows unauthenticated remote attackers to exhaust server CPU and memory resources.\nThis occurs because incoming unauthenticated WebSocket connections trigger resource allocation routines that are not properly cleaned up when the underlying socket closes prematurely.\nBy continuously opening and silently closing connections, an attacker can trigger unbounded memory allocation and CPU consumption via unmanaged timers and pending request arrays.\nThis leads to complete service unavailability affecting the Hub WebSocket server and client infrastructure.\nNo authentication or specific privileges are required to exploit this flaw, as the vulnerable code paths are exposed during the initial connection phase.\nExploitation requires network access to the WebSocket endpoint and the ability to establish TCP and WebSocket connections.",
  "technicalDetails": "The vulnerability resides within the WebSocket connection handling logic of the Hub application prior to version 0.2.16.\nThe vulnerable component is triggered whenever an incoming unauthenticated WebSocket connection is established.\nDuring this initial connection phase, the server executes loadDefaultConnectionEventListeners, which subsequently invokes requestClientId.\nThe requestClientId function calls rpc.send for the get-client-id action, pushing a new request object into the RPC.requests collection.\nConcurrently, the RPC.waitForReply function initiates a setInterval polling loop that executes every 10 milliseconds, designed to poll for a matching reply from the client.\nThe root cause of the vulnerability is an improper resource lifecycle management flaw in the socket termination path.\nSpecifically, if an unauthenticated client remains silent after connection establishment and abruptly closes the socket without responding, the cleanup logic fails to clear the active setInterval timer or remove the pending request from the RPC.requests collection.\nAs a result, the timer persists indefinitely in the Node.js event loop, and the stale request remains allocated in the heap.\nAn attacker exploits this behavior by scripting automated clients that repeatedly open unauthenticated WebSocket connections and immediately close them without completing the RPC handshake.\nEach connection leaves behind a persistent 10-millisecond polling interval and a dangling request entry.\nOver time, this rapid accumulation of orphaned timers and unbounded heap entries forces excessive garbage collection cycles and CPU contention, ultimately leading to resource exhaustion, memory leaks, and application crashes.\nThe attack vector is completely network-accessible, requires zero authentication or user interaction, and can be executed against any publicly exposed Hub server running affected versions below 0.2.16."
}