Unauthenticated ReDoS Vulnerability in Signal K Server by Signal K

CVE-2026-39320

What is CVE-2026-39320?

Signal K Server, a critical component for maritime applications, is susceptible to a Regular Expression Denial of Service (ReDoS) attack. This vulnerability can be exploited by an attacker injecting unescaped regex metacharacters into the context parameter in the WebSocket subscription logic. Consequently, the Node.js event loop may enter catastrophic backtracking, resulting in a persistent spike in CPU usage and complete unresponsiveness. As a result, legitimate API and socket requests can be effectively blocked. Users are advised to upgrade to version 2.25.0 or later, which addresses this significant security flaw.

References