# signalk-server (npm) vulnerabilities 16 known vulnerabilities (4 critical, 4 high, 6 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.37.0 (Nov 7, 2026): no advisory affects it - Newest unaffected release: 2.37.0 (Nov 7, 2026), the latest release - Weekly downloads: 8,434 - Dependents: 0 - Releases: 209 since 0.1.24 (Dec 27, 2016) - Registry: https://www.npmjs.com/package/signalk-server - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - GHSA-4XM8-RG9H-JHQ2: 2.0.0 to 2.33.0 (2.34.0 is outside it) - CVE-2026-115752: 2.28.0-beta.2 to 2.33.0 (2.34.0 is outside it) - CVE-2026-55591: 0.1.24 to 2.28.0-beta.2 (2.28.0 is outside it) - CVE-2026-41893: 0.1.24 to 2.24.0 (2.25.0 is outside it) - CVE-2026-39320: 0.1.24 to 2.24.0 (2.25.0 is outside it) - CVE-2026-35038: 0.1.24 to 2.24.0-beta.4 (2.24.0 is outside it) - CVE-2026-34083: 2.20.0 to 2.24.0-beta.4 (2.24.0 is outside it) - CVE-2026-33951: 0.1.24 to 2.23.0 (2.24.0-beta.3 is outside it) - CVE-2026-33950: 0.1.24 to 2.24.0-beta.3 (2.24.0-beta.4 is outside it) - CVE-2026-25228: 0.1.24 to 2.20.2 (2.20.3 is outside it) - CVE-2025-69203: 0.1.24 to 2.19.0-beta.5 (2.19.0 is outside it) - CVE-2025-68619: 0.1.24 to 2.8.3 (2.9.0 is outside it) - CVE-2025-68620: 0.1.24 to 2.19.0-beta.5 (2.19.0 is outside it) - CVE-2025-68273: 0.1.24 to 2.19.0-beta.5 (2.19.0 is outside it) - CVE-2025-68272: 0.1.24 to 2.19.0-beta.5 (2.19.0 is outside it) - CVE-2025-66398: 0.1.24 to 2.19.0-beta.5 (2.19.0 is outside it) ## Advisories (16) ### [GHSA-4XM8-RG9H-JHQ2](https://cve.now/GHSA-4XM8-RG9H-JHQ2): Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution - Severity: Critical - Published: Oct 30, 2026 - Affected: from 2.0.0, fixed in 2.34.0. - Fixed in 2.34.0 (released Oct 18, 2026, 12 days before disclosure). - The latest release, 2.37.0, is not affected. - 35% of signalk-server downloads last week were affected versions (3.8K). ### [CVE-2026-115752](https://cve.now/CVE-2026-115752): Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon - Severity: Low 2.3 - Published: Oct 23, 2026 - Affected: from 2.28.0-beta.2, fixed in 2.34.0. - Fixed in 2.34.0 (released Oct 18, 2026, 5 days before disclosure). - The latest release, 2.37.0, is not affected. - 12% of signalk-server downloads last week were affected versions (1.3K). ### [CVE-2026-55591](https://cve.now/CVE-2026-55591): Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints - Severity: Medium 5.8 - Published: Sep 15, 2026 - Affected: fixed in 2.28.0. - Fixed in 2.28.0 (released Jun 16, 2026, 91 days before disclosure). - The latest release, 2.37.0, is not affected. - 47% of signalk-server downloads last week were affected versions (5.1K). ### [CVE-2026-41893](https://cve.now/CVE-2026-41893): Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) - Severity: High 8.7 - Published: May 9, 2026 - Affected: fixed in 2.25.0. - Fixed in 2.25.0 (released Apr 19, 2026, 20 days before disclosure). - The latest release, 2.37.0, is not affected. - 45% of signalk-server downloads last week were affected versions (4.8K). ### [CVE-2026-39320](https://cve.now/CVE-2026-39320): Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths - Severity: High 7.5 - Published: Apr 21, 2026 - Affected: fixed in 2.25.0. - Fixed in 2.25.0 (released Apr 19, 2026, 2 days before disclosure). - The latest release, 2.37.0, is not affected. - 45% of signalk-server downloads last week were affected versions (4.8K). ### [CVE-2026-35038](https://cve.now/CVE-2026-35038): signalk-server: Arbitrary Prototype Read via \`from\` Field Bypass - Severity: Low 2.1 - Published: Apr 2, 2026 - Affected: fixed in 2.24.0. - Fixed in 2.24.0 (released Mar 26, 2026, 7 days before disclosure). - The latest release, 2.37.0, is not affected. - 44% of signalk-server downloads last week were affected versions (4.8K). ### [CVE-2026-34083](https://cve.now/CVE-2026-34083): signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow - Severity: Medium 6.1 - Published: Apr 2, 2026 - Affected: from 2.20.0, fixed in 2.24.0. - Fixed in 2.24.0 (released Mar 26, 2026, 7 days before disclosure). - The latest release, 2.37.0, is not affected. - 5.4% of signalk-server downloads last week were affected versions (583). ### [CVE-2026-33951](https://cve.now/CVE-2026-33951): signalk-server: Unauthenticated Source Priorities Manipulation - Severity: Medium 6.9 - Published: Apr 2, 2026 - Affected: fixed in 2.24.0-beta.1. - Fixed in 2.24.0 (released Mar 26, 2026, 7 days before disclosure, the advisory names 2.24.0-beta.1, which was never published). - The latest release, 2.37.0, is not affected. - 44% of signalk-server downloads last week were affected versions (4.8K). ### [CVE-2026-33950](https://cve.now/CVE-2026-33950): signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity - Severity: Critical 9.4 - Published: Apr 2, 2026 - Affected: fixed in 2.24.0-beta.4. - Fixed in 2.24.0-beta.4 (released Mar 25, 2026, 8 days before disclosure). - The latest release, 2.37.0, is not affected. - 44% of signalk-server downloads last week were affected versions (4.8K). ### [CVE-2026-25228](https://cve.now/CVE-2026-25228): SignalK Server has Path Traversal leading to information disclosure - Severity: Medium 5.0 - Published: Feb 2, 2026 - Affected: fixed in 2.20.3. - Fixed in 2.20.3 (released Jan 31, 2026, 2 days before disclosure). - The latest release, 2.37.0, is not affected. - 40% of signalk-server downloads last week were affected versions (4.3K). ### [CVE-2025-69203](https://cve.now/CVE-2025-69203): Signal K Server Vulnerable to Access Request Spoofing - Severity: Medium 6.3 - Published: Jan 1, 2026 - Affected: fixed in 2.19.0. - Fixed in 2.19.0 (released Jan 1, 2026, the day of disclosure). - The latest release, 2.37.0, is not affected. - 39% of signalk-server downloads last week were affected versions (4.2K). ### [CVE-2025-68619](https://cve.now/CVE-2025-68619): Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package - Severity: High 7.3 - Published: Jan 1, 2026 - Affected: fixed in 2.9.0. - Fixed in 2.9.0 (released Aug 23, 2024, 496 days before disclosure). - The latest release, 2.37.0, is not affected. - 28% of signalk-server downloads last week were affected versions (3K). ### [CVE-2025-68620](https://cve.now/CVE-2025-68620): Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling - Severity: Critical 9.1 - Published: Jan 1, 2026 - Affected: fixed in 2.19.0. - Fixed in 2.19.0 (released Jan 1, 2026, the day of disclosure). - The latest release, 2.37.0, is not affected. - 39% of signalk-server downloads last week were affected versions (4.2K). ### [CVE-2025-68273](https://cve.now/CVE-2025-68273): Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints - Severity: Medium 5.3 - Published: Jan 1, 2026 - Affected: fixed in 2.19.0. - Fixed in 2.19.0 (released Jan 1, 2026, the day of disclosure). - The latest release, 2.37.0, is not affected. - 39% of signalk-server downloads last week were affected versions (4.2K). ### [CVE-2025-68272](https://cve.now/CVE-2025-68272): Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding - Severity: High 7.5 - Published: Jan 1, 2026 - Affected: fixed in 2.19.0. - Fixed in 2.19.0 (released Jan 1, 2026, the day of disclosure). - The latest release, 2.37.0, is not affected. - 39% of signalk-server downloads last week were affected versions (4.2K). ### [CVE-2025-66398](https://cve.now/CVE-2025-66398): Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) - Severity: Critical 9.7 - Published: Jan 1, 2026 - Affected: fixed in 2.19.0. - Fixed in 2.19.0 (released Jan 1, 2026, the day of disclosure). - The latest release, 2.37.0, is not affected. - 39% of signalk-server downloads last week were affected versions (4.2K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/signalk-server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.