Executive brief
Signal K Server is an open-source marine data platform that manages real-time sensor data via WebSocket connections. An attacker can send a specially crafted WebSocket subscription request without authentication, causing the server's CPU to spike to 100% and become completely unresponsive to all requests. This results in total service unavailability and affects any vessel, sensor network, or marine system relying on Signal K for navigation and monitoring data.
Technical details
This is a Regular Expression Denial of Service (ReDoS) vulnerability in the subscription manager's contextMatcher() and pathMatcher() functions in subscriptionmanager.ts. The vulnerable code converts user-supplied wildcard strings directly into regular expressions, escaping only dots and asterisks but leaving other regex metacharacters (+, (, ), ?, [, ]) unescaped. An unauthenticated attacker can inject nested quantifiers (e.g., ([a-z0-9:-]+)+!) via a WebSocket subscription's context parameter. When the regex engine attempts to match this pattern against legitimate long identifiers (like vessels.urn:mrn:signalk:uuid:...), it triggers catastrophic backtracking with billions of evaluation attempts. Since Node.js uses a single-threaded event loop, this indefinitely locks the thread. The attack requires only network access to the WebSocket endpoint and no authentication. Signal K Server version 2.25.0 and later contain a fix.
Affected products
- Signal K Server All versions prior to 2.25.0
Timeline
- 2026-04-21: disclosed