What is the CVSS score of EUVD-2026-58175?

EUVD-2026-58175 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of anephenix hub are affected by EUVD-2026-58175?

@anephenix/hub npm package versions before 0.2.16 are vulnerable to denial-of-service attacks that exhaust server resources, with no public exploit identified at time of analysis.. A patch is available.

Is there a public PoC exploit available for EUVD-2026-58175?

Yes, a public proof-of-concept exploit is available for EUVD-2026-58175. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2026-58175?

Within 24 hours, audit your dependency inventory to identify all applications using @anephenix/hub versions before 0.2.16, including transitive dependencies resolved through npm. Within 7 days, upgrade all affected instances to @anephenix/hub v0.2.16 and deploy to production following your standard release validation process. Within 30 days, confirm patching completion across your full environment, document the upgrade in your change records, and monitor logs to verify no exploitation occurred during the vulnerability exposure window.

anephenix hub EUVD-2026-58175

| CVE-2026-73561 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-13 GitHub_M

GHSA-g5vv-q72c-7j78

Denial Of Service Node.js Hub

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-accessible default path requires no authentication or interaction; impact is purely availability with no data exposure or integrity change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Aug 13, 2026 - 19:04 EUVD

Source Code Evidence Fetched

Aug 13, 2026 - 18:23 vuln.today

Analysis Generated

Aug 13, 2026 - 18:23 vuln.today

CVE Published

Aug 13, 2026 - 17:24 cve.org

HIGH 7.5

DescriptionCVE.org

Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated because the socket close path does not cancel them. Repeated connections therefore cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. This issue is fixed in version 0.2.16.

Articles & Coverage 1

News 7 New Node.js Vulnerabilities - 1 Critical, 6 High, 4 With POC Aug 14, 2026

AnalysisAI

Resource exhaustion DoS in @anephenix/hub (npm) before 0.2.16 allows any unauthenticated remote client to exhaust server CPU and memory by opening WebSocket connections and ignoring all server RPC messages. Each connection triggers a 10ms setInterval polling loop and a heap entry in the RPC request queue; because the socket close handler never cancels these allocations, they accumulate without bound until the process becomes unresponsive. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in v0.2.16.

Technical ContextAI

@anephenix/hub is an npm package (cpe:2.3:a:anephenix:hub:*:*:*:*:*:*:*:*) providing a Node.js WebSocket server and client with built-in RPC and pub/sub capabilities. The root cause is CWE-400 (Uncontrolled Resource Consumption). On every accepted connection, loadDefaultConnectionEventListeners (src/lib/index.ts:128) invokes requestClientId, which calls rpc.send for the get-client-id action (src/lib/clientId.ts:112). Inside rpc.send, the payload is pushed onto this.requests (src/lib/rpc.ts:282) and waitForReply starts a setInterval polling responses[] every 10ms (src/lib/rpc.ts:250). The interval is cleared only when a matching reply arrives; the existing socket close handler only calls pubsub.unsubscribeClientFromAllChannels and never cancels pending RPC timers or queue entries. The fix in commit 931576d adds an onSocketClose handler passed to waitForReply via a new ws parameter: when the socket closes, it calls clearInterval, removes the request via removeItemFromQueue, and rejects the promise.

RemediationAI

Upgrade @anephenix/hub to version 0.2.16 or later using npm install @anephenix/hub@0.2.16; this is the vendor-confirmed fix documented in GHSA-g5vv-q72c-7j78 and implemented in commits 67260d2 and 931576d (https://github.com/anephenix/hub/commit/931576db3cdbf4f1583bd2c3c8759c4f4e032ab3). If an immediate upgrade is not feasible, apply rate-limiting or connection-count caps at the reverse proxy or load balancer (e.g., nginx limit_conn or HAProxy maxconn) to reduce the accumulation rate - note this slows but does not eliminate the leak, and introduces connection-refusal side effects for legitimate users under load. Blocking unauthenticated WebSocket access at the network boundary would fully prevent exploitation but disables hub's intended functionality for new clients. Full advisory: https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78.