High · published January 1, 2026
⚡ An unauthenticated flood can sink your Signal K Server! 🚢 A crafty attacker can exploit a Denial of Service (DoS) vulnerability, causing a crash with one simple trick. Picture a boat in a storm where a wayward sailor keeps throwing buckets of water into the engine room — eventually, it just can't take it anymore! This DoS vulnerability lets attackers overwhelm the server with requests, leading to a 'JavaScript heap out of memory' error, as if it’s drowning in data. If exploited, this vulnerability could take your Signal K Server offline, leaving your boat without critical navigation updates. This could be absolutely devastating for operations on the water, potentially putting the safety of the vessel and crew at risk. ⚠️ When the server crashes, you lose real-time access to vital information.
Picture a boat in a storm where a wayward sailor keeps throwing buckets of water into the engine room — eventually, it just can't take it anymore! This DoS vulnerability lets attackers overwhelm the server with requests, leading to a 'JavaScript heap out of memory' error, as if it’s drowning in data. The Denial of Service vulnerability in Signal K Server allows unauthenticated attackers to flood the access request endpoint (`/signalk/v1/access/requests`), which causes unbounded growth of request objects in memory. This leads to a crash due to exhausting available memory resources.
If exploited, this vulnerability could take your Signal K Server offline, leaving your boat without critical navigation updates. This could be absolutely devastating for operations on the water, potentially putting the safety of the vessel and crew at risk. ⚠️ When the server crashes, you lose real-time access to vital information. To protect your boat's Signal K Server, immediately update to version 2.19.0 or later. Monitor your server's logs for unusual traffic patterns and consider implementing rate limiting on the request endpoint. 🔧 You've got this! Following these steps will keep your server afloat and your data safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| signalk/signal_k_server | < 2.19.0 | 2.19.0 |