CVE-2026-39320
Description
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.
How to fix
- signalk signal_k_server2.25.0 or later
- signalk-server2.25.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| signalk signal_k_server | v < 2.25.0 | 2.25.0 |
| signalk-servernpm | v < 2.25.0 | 2.25.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.