CVE-2026-39320: Signal K Server Unauthenticated ReDoS Vulnerability via WebSocket Subscription Paths
Summary
CVE-2026-39320: The SignalK server is vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within its WebSocket subscription handling logic. Affects signalk-server versions < 2.25.0. Fixed in 2.25.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Signal K Server is an open-source server designed for marine data communication, enabling the exchange of information between various devices and applications. It utilizes WebSockets for real-time data streaming and supports a subscription model for clients to receive updates. However, the server has a vulnerability that allows unauthenticated users to exploit its WebSocket subscription handling, leading to potential Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability in Signal K Server arises from improper handling of user input in the context of regular expression (regex) matching. Specifically, the server's subscription management code fails to adequately escape certain regex metacharacters, allowing attackers to inject crafted patterns that can cause catastrophic backtracking in the regex engine. This results in the Node.js event loop being locked up, leading to a complete Denial of Service where the server becomes unresponsive. The vulnerability is particularly dangerous as it can be triggered by a single unauthenticated WebSocket connection, making it easy for attackers to exploit.
How To Fix
Latest published version: 2.34.0 as of 23 Oct 2026
npm install signalk-server@2.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.25.0
This is the first release that contains the fix.
npm install signalk-server@2.25.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize the context parameter before it is processed by the server. This can help mitigate the risk of regex injection. However, the best solution is to update to the patched version of the package.
Conclusion
The CVE-2026-39320 vulnerability in Signal K Server poses a significant risk of Denial of Service due to improper regex handling in WebSocket subscriptions. It is crucial for users to update to version 2.25.0 or later to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for signalk-server →
FAQ
A ReDoS (Regular Expression Denial of Service) attack exploits vulnerabilities in regex processing to cause excessive backtracking, leading to performance degradation or complete service unavailability.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
The primary consequence is a Denial of Service, where the server becomes unresponsive, affecting all users and applications relying on it for data.
No, the vulnerability does not lead to data loss; however, it can disrupt service availability, preventing users from accessing the server.
If an immediate update is not possible, implement input validation to sanitize user inputs and reduce the risk of exploitation until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for signalk-server.
