CVE-2026-73561

Name of the Vulnerable Software and Affected Versions Hub versions prior to 0.2.16

Description Unauthenticated WebSocket connections trigger the loadDefaultConnectionEventListeners function to call requestClientId, which subsequently executes rpc.send for the get-client-id action and adds a request to RPC.requests. The RPC.waitForReply function initiates a setInterval polling loop every 10 milliseconds that only clears upon receiving a matching reply. If a client closes the connection without responding, the timer and pending request remain allocated because the socket close path fails to cancel them. This leads to unbounded timers and heap entries, resulting in CPU and memory exhaustion that can make the server unavailable.

Recommendations Update Hub to version 0.2.16.