{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/anephenix/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@anephenix/hub \u003c 0.2.16"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","websocket","node.js"],"_cs_type":"advisory","_cs_vendors":["anephenix"],"content_html":"\u003cp\u003eA high-severity unauthenticated Denial-of-Service (DoS) vulnerability exists in the \u003ccode\u003e@anephenix/hub\u003c/code\u003e Node.js library, affecting all versions prior to 0.2.16. This flaw arises because the server initiates a \u003ccode\u003esetInterval\u003c/code\u003e polling loop and accumulates pending RPC request objects for every incoming WebSocket connection. Specifically, if a remote client fails to reply to the server's \u003ccode\u003eget-client-id\u003c/code\u003e RPC, these timers and corresponding request objects are never cleaned up, even after the WebSocket connection is terminated. An unauthenticated attacker can exploit this by establishing a large number of WebSocket connections and deliberately ignoring server RPC messages. This action causes the server to accumulate an unbounded number of \u003ccode\u003esetInterval\u003c/code\u003e timers and heap entries, leading to severe CPU and memory exhaustion and rendering the \u003ccode\u003e@anephenix/hub\u003c/code\u003e server unavailable to legitimate clients. The vulnerability does not require any authentication or specialized headers, making it easily exploitable.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated client establishes a WebSocket connection to the \u003ccode\u003e@anephenix/hub\u003c/code\u003e server.\u003c/li\u003e\n\u003cli\u003eThe server's connection listener, registered in \u003ccode\u003esrc/lib/index.ts:128\u003c/code\u003e, invokes \u003ccode\u003erequestClientId\u003c/code\u003e for the newly established WebSocket (\u003ccode\u003esrc/lib/index.ts:262\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003erequestClientId\u003c/code\u003e then calls \u003ccode\u003erpc.send\u003c/code\u003e to issue a \u003ccode\u003eget-client-id\u003c/code\u003e RPC request to the client (\u003ccode\u003esrc/lib/clientId.ts:112\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe RPC request payload is pushed onto the server's \u003ccode\u003ethis.requests\u003c/code\u003e array within \u003ccode\u003erpc.send\u003c/code\u003e (\u003ccode\u003esrc/lib/rpc.ts:282\u003c/code\u003e), marking it as a pending request.\u003c/li\u003e\n\u003cli\u003eInside \u003ccode\u003erpc.send\u003c/code\u003e, \u003ccode\u003ewaitForReply\u003c/code\u003e is invoked, which starts a \u003ccode\u003esetInterval\u003c/code\u003e timer polling every 10 ms to check for a matching reply in the \u003ccode\u003eresponses[]\u003c/code\u003e array (\u003ccode\u003esrc/lib/rpc.ts:250\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker's client deliberately ignores the server's \u003ccode\u003eget-client-id\u003c/code\u003e RPC message and then closes the WebSocket connection without sending any reply.\u003c/li\u003e\n\u003cli\u003eDue to the absence of a reply, the \u003ccode\u003esetInterval\u003c/code\u003e timer and the corresponding entry in \u003ccode\u003ethis.requests\u003c/code\u003e are not cleared, leading to a resource leak within the server process.\u003c/li\u003e\n\u003cli\u003eThe attacker repeats this process with numerous connections, causing an accumulation of unbounded timers and heap objects, ultimately leading to CPU and memory exhaustion and a Denial of Service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis is an unauthenticated Denial-of-Service (DoS) vulnerability affecting any network-reachable \u003ccode\u003e@anephenix/hub\u003c/code\u003e server running with default configurations. Exploitation allows an attacker to exhaust the server's CPU and memory resources by forcing it to accumulate an ever-increasing number of \u003ccode\u003esetInterval\u003c/code\u003e timers and heap entries. Each unanswered WebSocket connection contributes one \u003ccode\u003esetInterval\u003c/code\u003e timer (polling every 10 ms) and one heap object that is never released. As more connections are made and then silently dropped, the server's resource consumption spirals, leading to performance degradation and eventually making the server unresponsive or unavailable to legitimate clients. No complex authentication, headers, or protocol knowledge is required for successful exploitation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@anephenix/hub\u003c/code\u003e to version 0.2.16 or higher immediately to address the vulnerability.\u003c/li\u003e\n\u003cli\u003eMonitor server resource utilization (CPU, memory) for \u003ccode\u003e@anephenix/hub\u003c/code\u003e instances to detect anomalous spikes that could indicate a DoS attack.\u003c/li\u003e\n\u003cli\u003eImplement application-layer logging for WebSocket RPC requests and responses to track incomplete transactions that may indicate exploitation of this vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T21:53:58Z","date_published":"2026-07-24T21:53:58Z","id":"https://feed.craftedsignal.io/briefs/2026-07-anephenix-hub-dos/","summary":"An unauthenticated Denial-of-Service vulnerability in `@anephenix/hub` versions prior to 0.2.16 allows attackers to exhaust server CPU and memory resources by opening numerous WebSocket connections and ignoring server-initiated RPC messages, leading to unbounded timers and heap entries.","title":"@anephenix/hub Unauthenticated WebSocket RPC Waiter Resource Exhaustion (CVE-None)","url":"https://feed.craftedsignal.io/briefs/2026-07-anephenix-hub-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Anephenix","version":"https://jsonfeed.org/version/1.1"}