Imagine you're navigating a busy shipping channel at night, and every instrument on your boat — your chart plotter, wind sensors, depth gauge, AIS transponder — goes silent. Not because of a hardware failure. Because someone nearby sent a single, carefully crafted text message to your boat's software.
Who's Affected — and Why It Matters Beyond Sailors
Signal K Server is the open-source nervous system of the modern connected boat. It runs on a Raspberry Pi or similar hub below deck, aggregating data from every sensor onboard — GPS position, engine telemetry, weather instruments, autopilot — and pushing it to chart displays, phone apps, and cloud logging services. The project has thousands of active installations worldwide, spanning recreational sailors, bluewater cruisers, commercial fishing vessels, and marine research platforms.
CVE-2026-39320, scored 7.5 HIGH on the CVSS scale, affects all Signal K Server versions prior to 2.25.0. Because the flaw requires zero authentication to exploit — an attacker simply needs network access to the server's WebSocket port — vessels connected to marina Wi-Fi, satellite internet, or any shared network are potentially reachable. At sea, where that server IS your navigation infrastructure, this isn't just an IT inconvenience. It's a safety issue.
What an Attacker Can Actually Do
Signal K Server lets devices on the boat network subscribe to live data streams — think of it like tuning into a radio channel for, say, "give me all GPS updates every second." These subscriptions are requested over a WebSocket connection, a type of persistent, real-time communication link. When you subscribe, you tell the server which vessel you want data about, using a parameter called context.
Here's where it goes wrong. The server takes whatever you type into that context field and uses it as a search pattern to match against vessel identifiers — long strings like a boat's UUID. The problem is that the server never checks whether what you typed is safe to use as a search pattern. An attacker can send a specially crafted string stuffed with characters that have special meaning in pattern-matching — characters like *, +, (, and ) — and the server will try to process it anyway. When that poisoned pattern gets matched against a long identifier, the software's internal logic enters what engineers call catastrophic backtracking: it tries millions of possible interpretations in an exponentially growing loop, spiraling out of control. No login. No prior access. One message.
The result is immediate and total. The server's processor hits 100% utilization and stays there. The Node.js event loop — the single thread that handles every task the server does — is completely consumed. New sensor readings stop flowing. Chart displays go blank or freeze on stale data. The autopilot loses its data feed. The server becomes unresponsive to legitimate commands until it is manually restarted. On a vessel underway, that window of blindness is the danger.
The Technical Anchor: Catastrophic Backtracking via Unsanitized ReDoS in WebSocket Subscription Context
For security researchers: the vulnerability is a classic Regular Expression Denial of Service (ReDoS) residing in the WebSocket subscription handling logic of Signal K Server's Node.js backend. The context parameter of incoming subscription messages is passed directly into a regex evaluation pipeline without sanitization or metacharacter escaping. When the constructed pattern — containing unescaped quantifiers and grouping operators — is evaluated against the server's own self-UUID (a long, predictable-format string), the regex engine enters polynomial or exponential backtracking. Because Node.js runs a single-threaded event loop, this computation blocks all I/O, timer callbacks, and message processing, achieving a complete application-layer DoS with a single WebSocket frame. No authentication middleware intercepts unauthenticated WebSocket subscription requests prior to this evaluation. The vulnerability class is CWE-1333 (Inefficient Regular Expression Complexity).
Real-World Context: Discovered, Not Yet Exploited — But the Window Is Open
As of publication, there is no confirmed active exploitation of CVE-2026-39320 in the wild. No known threat campaigns have been attributed to this flaw, and no victims have been publicly identified. However, the security community's experience with ReDoS vulnerabilities is consistent: once a CVE with a working proof-of-concept is public, exploitation follows quickly, because the bar to attack is so low. You don't need sophisticated malware. You need a WebSocket client and one bad string.
The vulnerability was disclosed through responsible channels, and the Signal K project responded by releasing the patched version 2.25.0, which properly sanitizes and escapes metacharacters in the context parameter before any regex evaluation occurs. The turnaround reflects well on the project's security posture — but patching depends entirely on administrators actually applying the update, and in the marine world, software updates on embedded navigation systems are frequently deferred for months.
What You Should Do Right Now
-
Update to Signal K Server 2.25.0 or later — today.
If you're running Signal K on a Raspberry Pi or any other hub, SSH into the device and runnpm install -g signalk-serveror use the admin UI's built-in update function. Confirm the version number in the Signal K dashboard under Server → About. Any version below 2.25.0 is vulnerable. -
Restrict network access to your Signal K WebSocket port.
Signal K's WebSocket server typically listens on port 3000. Use your router's firewall rules or the boat's network switch to ensure this port is not accessible from untrusted networks — particularly marina guest Wi-Fi or public hotspots. If remote access is needed, route it through a VPN rather than exposing the port directly. This is good hygiene regardless of this specific CVE. -
Enable authentication on your Signal K instance if you haven't already.
While authentication would not prevent this specific attack (the vulnerable code path is hit before auth is checked), enabling Signal K's built-in security layer adds defense-in-depth against a wide range of other attack vectors. Navigate to Security → Users in the Signal K admin panel and set up access controls. While you're there, rotate any default credentials or shared passwords used on the vessel network.
CVE: CVE-2026-39320 | CVSS: 7.5 HIGH | Affected versions: Signal K Server < 2.25.0 | Fixed in: 2.25.0 | Exploitation status: No active exploitation confirmed