Search for packages
| purl | pkg:npm/signalk-server@2.20.3 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-69vq-fq3v-1yhf
Aliases: CVE-2026-41893 GHSA-vmfm-ch9h-5c7g |
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-rate-limit (default: 100 attempts per 10-minute window, configurable via HTTP_RATE_LIMITS). The WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been patched in version 2.25.0. |
Affected by 0 other vulnerabilities. |
|
VCID-aan1-ykx1-ckhm
Aliases: CVE-2026-33951 GHSA-gfmv-vh34-h2x5 |
Affected by 0 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
|
VCID-dbpe-ejtp-4kay
Aliases: CVE-2026-39320 GHSA-7gcj-phff-2884 |
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix. |
Affected by 0 other vulnerabilities. |
|
VCID-jb5w-972p-mkef
Aliases: CVE-2026-34083 GHSA-cxj8-ggf2-p57c |
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, SignalK Server contains a code-level vulnerability in its OIDC login and logout handlers where the unvalidated HTTP Host header is used to construct the OAuth2 redirect_uri. Because the redirectUri configuration is silently unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions in realistic deployments as The OIDC provider will then send the authorization code to whatever domain was injected. This issue has been patched in version 2.24.0. |
Affected by 2 other vulnerabilities. |
|
VCID-w1ny-rhsp-s3dh
Aliases: CVE-2026-33950 GHSA-x8hc-fqv3-7gwf |
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator access to the SignalK server at any time, allowing them to modify sensitive vessel routing data, alter server configurations, and access restricted endpoints. This issue has been patched in version 2.24.0-beta.4. |
Affected by 4 other vulnerabilities. |
|
VCID-xraa-e8gf-afdq
Aliases: CVE-2026-35038 GHSA-qh3j-mrg8-f234 |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-ngtr-u7an-x7ab | Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. This vulnerability is fixed in 2.20.3. |
CVE-2026-25228
GHSA-vrhw-v2hw-jffx |