CVE-2026-39320: Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to…
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.
- Published by source
- 2026-04-21
- First seen by Reality Radar
- 2026-10-27
- Last verified
- 2026-10-27
Affected
- Manufacturer
- signalk
- Products
- signal k server
- Versions
- <2.25.0
- CPE
- cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*
Whether your exact unit is affected depends on the model, serial number and region in the official notice.
What the official notice says
Risk: CVSS 7.5
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-04-21
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #2147 | new | 2026-10-27 | 84ca24989af3…730d7a | 9edc34a99991…b665c8 |
Chain head: #2286 e212558e872c…954bc1