CVE-2026-39320: Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression…

PriorityP342high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.43%

34.2th percentile

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
signalk	signal_k_server	< 2.25.0	2.25.0
signalk	signalk-server	< 2.25.0	2.25.0
signalk	signalk-server	>= 0 < 2.25.0	2.25.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.