Skip to main content
cve.nowby Sazabi
← npm
npmPackage

signalk-server

16 known vulnerabilities (4 critical, 4 high, 6 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
2.37.0 (Nov 7, 2026): no advisory affects it
Newest unaffected release
2.37.0 (Nov 7, 2026), the latest release
Advisories
16 · 4 critical, 4 high, 6 medium, 2 low
Weekly downloads
8,434
Dependents
0
Releases
209 since 0.1.24 (Dec 27, 2016)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 16 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 16

  • Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution

    Affected: from 2.0.0, fixed in 2.34.0.

    Fixed in 2.34.0 (released Oct 18, 2026, 12 days before disclosure).

    The latest release, 2.37.0, is not affected.

    35% of signalk-server downloads last week were affected versions (3.8K).

  • Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon

    Affected: from 2.28.0-beta.2, fixed in 2.34.0.

    Fixed in 2.34.0 (released Oct 18, 2026, 5 days before disclosure).

    The latest release, 2.37.0, is not affected.

    12% of signalk-server downloads last week were affected versions (1.3K).

  • CVE-2026-55591Medium 5.8

    Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

    Affected: fixed in 2.28.0.

    Fixed in 2.28.0 (released Jun 16, 2026, 91 days before disclosure).

    The latest release, 2.37.0, is not affected.

    47% of signalk-server downloads last week were affected versions (5.1K).

  • Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

    Affected: fixed in 2.25.0.

    Fixed in 2.25.0 (released Apr 19, 2026, 20 days before disclosure).

    The latest release, 2.37.0, is not affected.

    45% of signalk-server downloads last week were affected versions (4.8K).

  • Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths

    Affected: fixed in 2.25.0.

    Fixed in 2.25.0 (released Apr 19, 2026, 2 days before disclosure).

    The latest release, 2.37.0, is not affected.

    45% of signalk-server downloads last week were affected versions (4.8K).

  • signalk-server: Arbitrary Prototype Read via `from` Field Bypass

    Affected: fixed in 2.24.0.

    Fixed in 2.24.0 (released Mar 26, 2026, 7 days before disclosure).

    The latest release, 2.37.0, is not affected.

    44% of signalk-server downloads last week were affected versions (4.8K).

  • CVE-2026-34083Medium 6.1

    signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow

    Affected: from 2.20.0, fixed in 2.24.0.

    Fixed in 2.24.0 (released Mar 26, 2026, 7 days before disclosure).

    The latest release, 2.37.0, is not affected.

    5.4% of signalk-server downloads last week were affected versions (583).

  • CVE-2026-33951Medium 6.9

    signalk-server: Unauthenticated Source Priorities Manipulation

    Affected: fixed in 2.24.0-beta.1.

    Fixed in 2.24.0 (released Mar 26, 2026, 7 days before disclosure, the advisory names 2.24.0-beta.1, which was never published).

    The latest release, 2.37.0, is not affected.

    44% of signalk-server downloads last week were affected versions (4.8K).

  • CVE-2026-33950Critical 9.4

    signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity

    Affected: fixed in 2.24.0-beta.4.

    Fixed in 2.24.0-beta.4 (released Mar 25, 2026, 8 days before disclosure).

    The latest release, 2.37.0, is not affected.

    44% of signalk-server downloads last week were affected versions (4.8K).

  • CVE-2026-25228Medium 5.0

    SignalK Server has Path Traversal leading to information disclosure

    Affected: fixed in 2.20.3.

    Fixed in 2.20.3 (released Jan 31, 2026, 2 days before disclosure).

    The latest release, 2.37.0, is not affected.

    40% of signalk-server downloads last week were affected versions (4.3K).

  • CVE-2025-69203Medium 6.3

    Signal K Server Vulnerable to Access Request Spoofing

    Affected: fixed in 2.19.0.

    Fixed in 2.19.0 (released Jan 1, 2026, the day of disclosure).

    The latest release, 2.37.0, is not affected.

    39% of signalk-server downloads last week were affected versions (4.2K).

  • Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package

    Affected: fixed in 2.9.0.

    Fixed in 2.9.0 (released Aug 23, 2024, 496 days before disclosure).

    The latest release, 2.37.0, is not affected.

    28% of signalk-server downloads last week were affected versions (3K).

  • CVE-2025-68620Critical 9.1

    Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

    Affected: fixed in 2.19.0.

    Fixed in 2.19.0 (released Jan 1, 2026, the day of disclosure).

    The latest release, 2.37.0, is not affected.

    39% of signalk-server downloads last week were affected versions (4.2K).

  • CVE-2025-68273Medium 5.3

    Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

    Affected: fixed in 2.19.0.

    Fixed in 2.19.0 (released Jan 1, 2026, the day of disclosure).

    The latest release, 2.37.0, is not affected.

    39% of signalk-server downloads last week were affected versions (4.2K).

  • Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding

    Affected: fixed in 2.19.0.

    Fixed in 2.19.0 (released Jan 1, 2026, the day of disclosure).

    The latest release, 2.37.0, is not affected.

    39% of signalk-server downloads last week were affected versions (4.2K).

  • CVE-2025-66398Critical 9.7

    Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

    Affected: fixed in 2.19.0.

    Fixed in 2.19.0 (released Jan 1, 2026, the day of disclosure).

    The latest release, 2.37.0, is not affected.

    39% of signalk-server downloads last week were affected versions (4.2K).