CVE-2025-68272: Signal K Server Denial of Service via Unrestricted Access Request Flooding
Summary
CVE-2025-68272: Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding. Affects signalk-server versions < 2.19.0. Fixed in 2.19.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Signal K Server is an open-source platform designed for marine navigation and data sharing. It enables communication between various devices and systems on a vessel, providing real-time access to navigation data. The server is built using Node.js and is widely used in the maritime community for its flexibility and extensibility. However, it is vulnerable to a Denial of Service (DoS) attack due to improper handling of access requests, which can lead to service outages.
Vulnerability Detail
The vulnerability arises from a lack of rate limiting and poor memory management for incoming access requests at the endpoint /signalk/v1/access/requests. An unauthenticated attacker can exploit this by sending a flood of requests, causing the server to exhaust its memory and crash. The requests are stored in memory without any size checks, leading to rapid memory consumption and eventual failure of the Node.js process with a 'heap out of memory' error.
How To Fix
Latest published version: 2.34.0 as of 23 Oct 2026
npm install signalk-server@2.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.19.0
This is the first release that contains the fix.
npm install signalk-server@2.19.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a reverse proxy with rate limiting capabilities (e.g., using Nginx or Apache) in front of the Signal K Server to limit the number of requests from a single IP address.
Conclusion
The CVE-2025-68272 vulnerability in Signal K Server poses a significant risk of Denial of Service due to improper handling of access requests. It is crucial to update to the patched version and implement additional security measures to protect against potential attacks.
See every vulnerability recorded for signalk-server →
FAQ
CVE-2025-68272 is a vulnerability in the Signal K Server that allows an unauthenticated attacker to crash the server by flooding it with access requests.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your package-lock.json without any signup.
The vulnerability can lead to service unavailability, causing the server to crash and requiring a manual restart to recover, which can disrupt navigation data access.
Yes, the vulnerability has been patched in version 2.19.0 of the Signal K Server. It is recommended to update to this version to mitigate the risk.
If an immediate update is not possible, consider implementing a reverse proxy with rate limiting to help mitigate the risk of exploitation until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for signalk-server.
