CVE-2025-68272: 
JavaScript vulnerability analysis and mitigation

CVE-2025-68272 is a Denial of Service (DoS) vulnerability in Signal K Server, a Node.js-based navigation data hub application used on boats. An unauthenticated attacker can crash the server by flooding the access request endpoint (/signalk/v1/access/requests), causing a "JavaScript heap out of memory" fatal error due to unbounded in-memory storage of request objects. All versions prior to 2.19.0 are affected; version 2.19.0 resolves the issue. The vulnerability was published on January 1, 2026, with a CVSS v3.1 base score of 7.5 (High) (Github Advisory, SignalK Advisory).

The root cause is uncontrolled resource consumption (CWE-400) combined with allocation of resources without limits or throttling (CWE-770). In src/requestResponse.js, incoming access requests are stored in a plain JavaScript object (const requests = {}) via the createRequest function, which imposes no cap on the number or size of stored entries. The pruneRequests cleanup function runs only once every 15 minutes, providing no meaningful protection against rapid flooding. Because the /signalk/v1/access/requests endpoint is intentionally unauthenticated (to allow new clients to request access), there is no authentication barrier, and no rate limiting is applied. A public proof-of-concept Python script is included in the advisory, demonstrating that sending 20,000+ POST requests with 100KB payloads each exhausts the Node.js heap (~1.5GB default limit) and crashes the process (SignalK Advisory).

Successful exploitation results in complete service unavailability of the Signal K Server, requiring a manual restart to recover. Because Signal K Server aggregates and serves vessel navigation data (GPS, AIS, instrument readings), a crash directly disrupts maritime navigation systems and any dependent applications or displays aboard the vessel. There is no confidentiality or integrity impact — the attack is purely an availability concern — but in a maritime safety context, loss of navigation data services could have serious operational consequences (SignalK Advisory).

A public proof-of-concept exploit script is included in the official GitHub Security Advisory and requires no authentication, no special privileges, and no user interaction to execute. The EPSS score is approximately 0.085% (0.00107 per Feedly), indicating a low but non-zero probability of exploitation in the wild. No in-the-wild exploitation has been confirmed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack is trivially reproducible using standard Python libraries (Github Advisory, SignalK Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Signal K Server instances (default port 3000) using tools like Shodan, Censys, or direct network scanning. Confirm the server version is prior to 2.19.0 by querying the Signal K API (e.g., GET /signalk/v1/api/).
2. Prepare the payload: Craft a JSON POST body with a large description field (e.g., 100KB of repeated characters) and arbitrary clientId and permissions values, as the endpoint requires no authentication.
3. Flood the endpoint: Send 20,000+ concurrent POST requests to /signalk/v1/access/requests using a multithreaded script (50 concurrent threads as demonstrated in the PoC). Each request stores a new object in the Node.js heap.
4. Trigger OOM crash: The Node.js process memory usage spikes rapidly (~30MB per second observed in testing). When the heap reaches its limit (~1.5GB by default), the process terminates with FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory.
5. Achieve DoS: The Signal K Server becomes completely unresponsive and requires a manual restart, taking vessel navigation data services offline (SignalK Advisory).

• Network: High volume of HTTP POST requests to /signalk/v1/access/requests from one or more source IPs in a short time window; requests with unusually large JSON body sizes (e.g., >10KB in the description field).
• Logs: Signal K Server access logs showing thousands of POST requests to /signalk/v1/access/requests within seconds or minutes; Node.js process logs containing FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory.
• Process: Rapid increase in Node.js process memory consumption (RSS/heap) observable via system monitoring tools (e.g., top, htop, ps); unexpected termination of the signalk-server Node.js process.
• System: Unexpected service restarts or crash reports for the Signal K Server daemon/service; system OOM killer events in kernel logs (dmesg) if the OS intervenes before Node.js self-terminates (SignalK Advisory).

Upgrade Signal K Server to version 2.19.0 or later, which includes security fixes for this vulnerability (v2.19.0 Release). For operators unable to patch immediately, the following mitigations should be applied: (1) implement network-level access controls (firewall rules) to restrict access to port 3000 and the /signalk/v1/access/requests endpoint to trusted IP ranges only; (2) deploy a reverse proxy (e.g., nginx) with rate limiting configured for the vulnerable endpoint; (3) enforce payload size limits at the network or proxy layer. The v2.19.0 release notes explicitly flag this as an important security fix and recommend immediate update for any server accessible from the internet (SignalK Advisory).

The advisory was published by Signal K maintainer tkurki on January 1, 2026, with the v2.19.0 release notes explicitly urging immediate updates for internet-accessible servers. The vulnerability was credited to researcher NoNoNGU. Coverage appeared on security aggregators including CVEFeed, Vulners, and The Hacker Wire shortly after disclosure, and the advisory was reviewed and published to the GitHub Advisory Database on January 2, 2026 (Github Advisory, v2.19.0 Release).