Executive brief
Signal K Server is an open-source navigation data server used to manage vessel maritime information systems. An unauthenticated attacker can crash the server by flooding the access request endpoint with large payloads, causing the application to exhaust all available memory and become completely unavailable until manually restarted. This disrupts navigation and operational services on the affected vessel.
Technical details
This denial-of-service vulnerability exists in the access request handling code (src/requestResponse.js) due to unbounded in-memory storage of request objects without rate limiting or payload size validation. The /signalk/v1/access/requests endpoint accepts POST requests from unauthenticated clients and stores all incoming requests in a JavaScript object that grows without bounds. The pruneRequests function only runs once every 15 minutes, allowing attackers to send thousands of requests (or requests with 100KB+ payloads) faster than they are cleaned up, causing rapid heap memory exhaustion. An attacker on the network can trigger a "JavaScript heap out of memory" crash with a simple flood attack sending 20,000+ requests. The vulnerability is fixed in version 2.19.0 through implementation of rate limiting, request storage limits, and payload size validation.
Affected products
- Signal K signalk-server <= 2.18.0
Timeline
- 2026-01-02: disclosed
- 2026-01-02: patched: Version 2.19.0 released