# CVE-2025-68272: Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding

Source: https://junglewise.ai/threats/cve-2025-68272-signal-k-server-vulnerable-to-denial-of-service-via-unrestricted  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-68272 · Severity: high · CVSS 7.5 · Published 2026-01-01

Signal K Server is an open-source navigation data server used to manage vessel maritime information systems. An unauthenticated attacker can crash the server by flooding the access request endpoint with large payloads, causing the application to exhaust all available memory and become completely unavailable until manually restarted. This disrupts navigation and operational services on the affected vessel.

Technologies: [signalk-server (npm)](https://junglewise.ai/threats/technologies/signalk-server), [Signalk Signal K Server](https://junglewise.ai/threats/technologies/signalk-signal-k-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Signalk](https://junglewise.ai/threats/vendors/signalk).

## Quick answers

**Is CVE-2025-68272 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-68272 being exploited in the wild.

**How severe is CVE-2025-68272?** High severity, with a CVSS score of 7.5, published 1 January 2026.

**Which products and versions are affected?** signalk-server (npm) < 2.19.0, SEMVER:introduced=0,fixed=2.19.0.

**Is there a fix for CVE-2025-68272?** Yes. signalk-server (npm): upgrade to 2.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-68272 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-68272?** Check whether you run signalk-server (npm) or Signalk Signal K Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- signalk-server (npm): upgrade to 2.19.0 or later

  ```sh
  npm install signalk-server@2.19.0
  ```


## Technical details

This denial-of-service vulnerability exists in the access request handling code (src/requestResponse.js) due to unbounded in-memory storage of request objects without rate limiting or payload size validation. The /signalk/v1/access/requests endpoint accepts POST requests from unauthenticated clients and stores all incoming requests in a JavaScript object that grows without bounds. The pruneRequests function only runs once every 15 minutes, allowing attackers to send thousands of requests (or requests with 100KB+ payloads) faster than they are cleaned up, causing rapid heap memory exhaustion. An attacker on the network can trigger a "JavaScript heap out of memory" crash with a simple flood attack sending 20,000+ requests. The vulnerability is fixed in version 2.19.0 through implementation of rate limiting, request storage limits, and payload size validation.

## Affected products

- Signal K signalk-server <= 2.18.0

## Identifiers

- CVE-2025-68272
- GHSA-7rqc-ff8m-7j23

## Timeline

- 2026-01-02: disclosed
- 2026-01-02: patched: Version 2.19.0 released

## References

- [https://github.com/SignalK/signalk-server/security/advisories/GHSA-7rqc-ff8m-7j23](https://github.com/SignalK/signalk-server/security/advisories/GHSA-7rqc-ff8m-7j23)

## Related threats

- [Signal K Server buffered logs exposure in unauthenticated WebSocket](https://junglewise.ai/threats/signal-k-server-buffered-logs-exposed-to-unauthenticated-websocket-b7032aad)
- [Signal K resources API path traversal and RCE](https://junglewise.ai/threats/signal-k-resources-api-path-traversal-can-disclose-the-jwt-signing-0c6398ee)
- [Signal K Server SSRF in App Store icon fetcher](https://junglewise.ai/threats/cve-2026-115752-signal-k-server-from-2-28-0-beta-2-before-2-34-0-contains-a)
- [Signal K Server SSRF in remote connection endpoints](https://junglewise.ai/threats/cve-2026-55591-signal-k-server-ssrf-in-remote-connection-endpoints)
- [SignalK Signal K Server brute-force protection bypass in WebSocket login](https://junglewise.ai/threats/cve-2026-41893-signalk-signal-k-server-brute-force-protection-bypass-in)