CVE-2026-73561Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated because the socket close path does not cancel them. Repeated connections therefore cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. This issue is fixed in version 0.2.16.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-400

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-08-13); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-13	2	Disclosure2
2026-08-14	1	Disclosure1

Full discourse3 posts

Vulmon Vulnerability Feed@VulmonFeeds46d
Disclosure
CVE-2026-73561 Hub Node.js WebSocket Server Unbounded Timer Heap Exhaustion Vuln... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73561 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
A new CVE-2026-73561 is disclosed, identified as an unbounded timer heap exhaustion issue in the Hub Node.js WebSocket Server, with no PoC, exploit, active exploitation, patch, or false‑positive information provided.
00000107
4.1K followersView on X
Infoflowcloud@infoflowcloud46d
Disclosure
🚨*CVE* CVE-2026-73561 Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionE… https://www.cve.org/CVERecord?id=CVE-2026-73561 ----- Traducción: CVE-2026-73561 Hub… https://infoflow.cloud`
Post summary
The text announces CVE-2026-73561, highlighting a flaw in Hub’s Node.js WebSocket server where unauthenticated connections pre‑0.2.16 trigger loadDefaultConnectionE.
0000022
97 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-73561 Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionE… https://www.cve.org/CVERecord?id=CVE-2026-73561
Post summary
The text describes CVE-2026-73561 as a flaw in Hub's WebSocket server where unauthenticated connections prior to version 0.2.16 trigger a function, with no PoC, exploit, or correction information provided.
000001.3K
57.9K followersView on X

Explore more

Back to dashboard