Hub is a Node.js WebSocket server that, before version 0.2.16, starts an unbounded polling loop for every unauthenticated connection, allocating timers and heap entries that are never freed when the socket closes. This causes CPU and memory exhaustion, preventing the server from processing legitimate traffic and resulting in denial of service. The vulnerability is a classic example of an unregulated resource exhaustion flaw identified as CWE-400.

Anephenix Hub, the Node.js WebSocket server and client, is affected in all releases prior to version 0.2.16. Users running 0.2.15 or earlier should verify their installed version and consider an update.

The CVSS score of 7.5 indicates a medium‑to‑high severity, and the EPSS score is not available, but the lack of authentication on WebSocket connections and the straightforward exploitation path suggest a high likelihood of attack. The vulnerability is not listed in CISA’s KEV catalog, but an attacker can trigger resource exhaustion simply by opening many unauthenticated WebSocket connections, which can be automated from a remote location.