CVE-2026-39320: high-severity vulnerability in signalk-server
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.4%
exploitation probability
0.4%top 63% of all CVEs
observed exploitation
nono source reports it
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
SignalK · signalk-serverRelated CVEs — signalk-server
In the same product, most dangerous first.
CVE-2025-66398CRITICALSignal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)EPSS 19.9%CVE-2026-23515CRITICALRCE - Command Injection in Signal K set-system-time pluginEPSS 4.6%CVE-2025-68273MEDIUMSignal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed EndpointsEPSS 0.8%CVE-2025-68619HIGHSignal K Server Vulnerable to Remote Code Execution via Malicious npm PackageEPSS 0.7%CVE-2025-68272HIGHSignal K Server Vulnerable to Denial of Service via Unrestricted Access Request FloodingEPSS 0.6%CVE-2025-68620CRITICALSignal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated PollingEPSS 0.5%