CVE-2026-39320: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39320 is an unauthenticated Regular Expression Denial of Service (ReDoS) vulnerability in Signal K Server, a marine data hub application. All versions prior to 2.25.0 are affected. By injecting unescaped regex metacharacters into the context parameter of a WebSocket stream subscription, an unauthenticated attacker can trigger catastrophic backtracking in the Node.js event loop, causing a complete server freeze. The vulnerability was published on April 19–21, 2026, with a fix released in version 2.25.0. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Github Advisory).

The root cause lies in flawed string-to-regex conversion within signalk-server/src/subscriptionmanager.ts, classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-1333 (Inefficient Regular Expression Complexity). The contextMatcher() and pathMatcher() functions convert user-supplied wildcard strings into regular expressions, escaping only . and * while leaving other regex metacharacters — such as +, (, ), ?, [, and ] — unescaped. An attacker can submit a crafted context value like vessels.([a-z0-9:-]+)+!, which compiles into the regex ^vessels\.([a-z0-9:-]+)+!$; when tested against a long server UUID string (e.g., vessels.urn:mrn:signalk:uuid:d384dc156010), the nested quantifier triggers exponential backtracking — up to 2^38 evaluations — permanently locking Node.js's single-threaded event loop. No authentication is required, and exploitation requires only a single WebSocket message (GitHub Advisory).

Successful exploitation results in a complete Denial of Service (DoS) against the Signal K Server: CPU spikes to 100% and the server becomes entirely unresponsive to all subsequent API and WebSocket requests. There is no confidentiality or integrity impact — the attack is purely an availability attack. In a maritime context, Signal K Server acts as a central data hub for vessel instrumentation, so a successful attack could disrupt navigation data aggregation and connected onboard systems (GitHub Advisory, Github Advisory).

A fully functional proof-of-concept (PoC) exploit is publicly available in the GitHub security advisory, written in JavaScript/Node.js. The PoC establishes a WebSocket connection and sends a single malicious JSON payload to freeze the server, with HTTP polling to confirm unresponsiveness. No authentication or special privileges are required. The EPSS score is approximately 0.075% (23rd percentile), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing (GitHub Advisory, Github Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Signal K Server instances (default port 3000) running versions prior to 2.25.0 using tools like Shodan or Censys, or by scanning local marine networks.
2. Establish WebSocket connection: Connect to the Signal K WebSocket stream endpoint: ws://<target>:3000/signalk/v1/stream?subscribe=none using any WebSocket client (e.g., the ws Node.js library).
3. Send malicious subscription payload: Once connected, transmit the following JSON payload containing a crafted context value with nested regex quantifiers:

{
  "context": "vessels.([a-z0-9:-]+)+!",
  "announceNewPaths": true,
  "subscribe": [{ "path": "*" }]
}

4. Trigger catastrophic backtracking: The server's contextMatcher() function compiles the attacker-controlled string into the regex ^vessels\.([a-z0-9:-]+)+!$ and tests it against the server's own UUID (e.g., vessels.urn:mrn:signalk:uuid:d384dc156010), triggering up to 2^38 backtracking operations.
5. Achieve DoS: The Node.js event loop is permanently blocked; the server CPU reaches 100% and stops responding to all API and WebSocket requests. Verify by polling http://<target>:3000/signalk/v1/api/ and observing timeouts (GitHub Advisory).

• Network: Unexpected WebSocket connections to /signalk/v1/stream from unknown or external IP addresses; WebSocket subscription messages containing regex metacharacters (+, (, ), ?, [, ]) in the context field.
• Process: Signal K Server Node.js process consuming sustained 100% CPU with no corresponding increase in legitimate client activity.
• Logs: Signal K access or application logs showing a WebSocket subscription message with a context value matching patterns like vessels.([a-z0-9:-]+)+! or similar nested quantifier constructs; subsequent log entries ceasing entirely after the malicious message is received.
• Availability: HTTP API endpoint (/signalk/v1/api/) becoming unresponsive or timing out (>2 seconds) immediately following a WebSocket connection event (GitHub Advisory).

Upgrade Signal K Server to version 2.25.0 or later, which contains a fix for this vulnerability (the v2.25.0 release also includes a separate fix for a ReDoS in the chart tile route regex) (v2.25.0 Release). If immediate patching is not possible, implement network-level controls to restrict WebSocket access to the Signal K port (default 3000) to trusted IP addresses only. Monitor server CPU usage for sustained spikes correlated with WebSocket activity as a detection measure (Github Advisory).

The vulnerability was reported by researcher VashuVats and published by Signal K maintainer tkurki via GitHub's security advisory process. The advisory received coverage from automated CVE tracking services and security aggregators including ENISA's EUVD, INCIBE-CERT, and Bluesky CVE feeds shortly after disclosure. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability database entries (Github Advisory).