Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-39320: Signal K Server can be halted by unauthenticated WebSocket request

CVE-2026-39320 · published 6 months ago

Summary

Versions of Signal K Server before 2.25.0 let anyone send a specially crafted WebSocket subscription that overloads the server's processing. This causes the CPU to max out and the server to stop responding, interrupting boat data services. Update to version 2.25.0 or later to stop the problem.

What to do

Update GitHub Actions signalk-server to version 2.25.0.
Update signalk signal_k_server to version 2.25.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	GitHub Actions	signalk-server	< 2.25.0 Fix: upgrade to 2.25.0
–	signalk	signal_k_server	< 2.25.0 `cpe:2.3:a:signalk:signal_k_server::::::::`

Original advisory text

Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.

References

https://github.com/advisories/GHSA-7gcj-phff-2884
https://github.com/SignalK/signalk-server/releases/tag/v2.25.0 Product Release Notes
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39320... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-39320 Vendor Advisory
https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e... Patch
https://github.com/SignalK/signalk-server/pull/2568 Issue Tracking Patch
https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-288... Exploit Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-400Uncontrolled Resource Consumption

CWE-1333Inefficient Regular Expression Complexity (ReDoS)

Timeline

Published21 Apr 2026

Updated4 Nov 2026

First seen21 Apr 2026

Sources

CVE-2026-39320 · NVD

GHSA-7gcj-phff-2884 · GHSA

CVE-2026-39320 · OSV

Track software like this

Free during beta