current-impact (1.0.0), nmea-streamer (>=1.0.1, <=2.2.0) potentially affected by CVE-2026-25228 via signalk-server (1.46.3)

signalk-server NPM version 1.46.3 is affected by a known vulnerability. The following packages have a transitive dependency on signalk-server and may be impacted: - current-impact 1.0.0 - nmea-streamer =1.0.1, =2.2.0 Source cves: CVE-2026-25228 Source advisory: MEND:CVE-2026-25228...

Directory Traversal

Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Directory Traversal via improper validation in the validateAppId function. An attacker can access arbitrary files and directories outside the intended directory by...

SignalK Server has Path Traversal leading to information disclosure

Summary A Path Traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId function blocks forward slashes / but not backslashes , which are treated as...

GHSA-VRHW-V2HW-JFFX SignalK Server has Path Traversal leading to information disclosure

Summary A Path Traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId function blocks forward slashes / but not backslashes , which are treated as...

signalk-server (>=1.0.0-0, <=1.1.2) potentially affected by CVE-2026-23515 via @signalk/set-system-time (>=1.0.0, <=1.2.0)

@signalk/set-system-time NPM version =1.0.0, =1.0.0-0, =1.1.2 Source cves: CVE-2026-23515 Source advisory: MEND:CVE-2026-23515...

signalk-server (>=1.0.0-0, <=1.1.2) potentially affected by CVE-2026-23515 via @signalk/set-system-time (>=1.0.0, <=1.2.0)

@signalk/set-system-time NPM version =1.0.0, =1.0.0-0, =1.1.2 Source cves: CVE-2026-23515 Source advisory: SNYK:JS-SIGNALKSETSYSTEMTIME-15182653...

signalk-server (>=1.0.0-0, <=1.1.2) potentially affected by CVE-2026-23515 via @signalk/set-system-time (>=1.0.0, <=1.2.0)

@signalk/set-system-time NPM version =1.0.0, =1.0.0-0, =1.1.2 Source cves: CVE-2026-23515 Source advisory: OSV:GHSA-P8GP-2W28-MHWG...

signalk-server (>=1.0.0-0, <=1.1.2) potentially affected by CVE-2026-23515 via @signalk/set-system-time (>=1.0.0, <=1.2.0)

@signalk/set-system-time NPM version =1.0.0, =1.0.0-0, =1.1.2 Source cves: CVE-2026-23515 Source advisory: GHSA-P8GP-2W28-MHWG...

CVE-2026-25228: Improper Limitation of a Pathname to a Restricted Directory

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The...

Denial Of Service (DoS)

signalk-server is vulnerable to Denial of Service DoS. The vulnerability is due to unbounded in-memory storage of access request objects at the /signalk/v1/access/requests endpoint, which allows an unauthenticated attacker to flood the endpoint and crash the server through memory exhaustion...

Unauthenticated Information Disclosure

signalk-server is vulnerable to unauthenticated information disclosure. The vulnerability is due to missing authentication checks on sensitive endpoints, which allows an attacker to retrieve internal system details such as the full SignalK data schema, connected serial devices, and installed...

CVE-2025-68620

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated...

Authentication Bypass Using an Alternate Path or Channel

Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the startServerEvents and queryRequest functions. When allowreadonly is enabled, an unauthenticated...

EUVD-2025-206135

Signal K Server Vulnerable to Access Request Spoofing...

Arbitrary Code Injection

Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Arbitrary Code Injection via the appstore.js REST API endpoint, which allows the installation of npm packages using unsanitized version specifiers. An administrator...

Information Exposure

Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Information Exposure via the exposed endpoints /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer that are not protected by authentication...

Allocation of Resources Without Limits or Throttling

Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the /signalk/v1/access/requests endpoint. An attacker can cause the server to exhaust memory resources and...

GHSA-7RQC-FF8M-7J23 Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding

Summary A Denial of Service DoS vulnerability allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint /signalk/v1/access/requests. This causes a "JavaScript heap out of memory" error due to unbounded in-memory storage of request objects. Details The...

Improper Control of Dynamically-Managed Code Resources

Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the restoreFilePath global variable, which can be manipulated through the /skServer/validateBackup endpoin...

PT-2026-6416

SignalK Server exposes two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated polling of access request status. Unauthenticated WebSocket Request Enumeration: When ...