{"id":"EUVD-2026-24021","enisaUuid":"191f760e-c75f-3374-bdc7-3d242ea2e70d","description":"Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server\u0027s Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server\u0027s self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.","datePublished":"Apr 21, 2026, 12:07:10 AM","dateUpdated":"Apr 21, 2026, 7:36:54 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884\nhttps://github.com/SignalK/signalk-server/pull/2568\nhttps://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d\nhttps://github.com/SignalK/signalk-server/releases/tag/v2.25.0\n","aliases":"CVE-2026-39320\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"f157afc2-9478-3214-95c1-2f24b9a371b4","product":{"name":"signalk-server","vendor":{"name":"SignalK"}},"product_version":"\u003c 2.25.0"}],"enisaIdVendor":[{"id":"9b48791f-5c98-3787-9e30-86146ce0531b","vendor":{"name":"SignalK"}}],"enisaIdVulnerability":[{"id":"ba41de05-ebc2-3253-835e-619c78bc88e0","vulnerability":{"id":"CVE-2026-39320","description":"Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server\u0027s Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server\u0027s self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.","datePublished":"Apr 21, 2026, 12:07:10 AM","dateUpdated":"Apr 21, 2026, 7:36:54 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884\nhttps://github.com/SignalK/signalk-server/pull/2568\nhttps://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d\nhttps://github.com/SignalK/signalk-server/releases/tag/v2.25.0\n","enisa_id":"EUVD-2026-24021\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Oct 27, 2026, 7:13:18 AM","vulnerabilityProduct":[{"id":"3221f6f0-5aa9-3bb4-8107-68357fc886ce","product":{"name":"signalk-server","vendor":{"name":"SignalK"}},"product_version":"\u003c 2.25.0"}],"vulnerabilityVendor":[{"id":"ccdbca40-cd8b-37a9-b2a1-fc288e4a2347","vendor":{"name":"SignalK"}}]}},{"id":"cba5c1ce-02db-387b-a923-af8a53b3bdeb","vulnerability":{"id":"GHSA-7gcj-phff-2884","description":"Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths","datePublished":"Apr 21, 2026, 5:17:00 PM","dateUpdated":"Apr 21, 2026, 5:17:00 PM","baseScore":0.0,"references":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-39320\nhttps://github.com/SignalK/signalk-server/pull/2568\nhttps://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d\nhttps://github.com/SignalK/signalk-server\nhttps://github.com/SignalK/signalk-server/releases/tag/v2.25.0\n","enisa_id":"EUVD-2026-24021\n","aliases":"GHSA-7gcj-phff-2884\nCVE-2026-39320\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}