CVE-2025-68272: Signal K Server DoS Vulnerability

CVE-2025-68272 Overview

Signal K Server is a server application designed to run on a central hub in a boat, providing a modern and open data format for marine electronics. A Denial of Service (DoS) vulnerability exists in versions prior to 2.19.0 that allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (/signalk/v1/access/requests). This vulnerability results in a "JavaScript heap out of memory" error due to unbounded in-memory storage of request objects, effectively rendering the marine navigation system unusable.

Critical Impact

Unauthenticated attackers can remotely crash Signal K Server instances, potentially disrupting critical marine navigation and monitoring systems on vessels.

Affected Products

• Signal K Server versions prior to 2.19.0
• signalk signal_k_server (all platforms)
• Marine vessel systems running vulnerable Signal K Server deployments

Discovery Timeline

• 2026-01-01 - CVE CVE-2025-68272 published to NVD
• 2026-01-06 - Last updated in NVD database

Technical Details for CVE-2025-68272

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), a resource exhaustion condition that affects the Signal K Server's access request handling mechanism. The flaw exists in how the server processes incoming requests to the /signalk/v1/access/requests endpoint without implementing proper rate limiting or memory bounds checking.

When an attacker sends a large volume of requests to this endpoint, the server stores each request object in memory without any limits. This unbounded allocation eventually exhausts the available JavaScript heap memory, causing the Node.js process to terminate with an out-of-memory error. The attack is particularly dangerous because it requires no authentication, meaning any network-accessible attacker can exploit it.

The vulnerability poses significant risks in maritime environments where Signal K Server often serves as a critical component of integrated navigation systems, aggregating data from various marine instruments and sensors.

Root Cause

The root cause of this vulnerability lies in the lack of request rate limiting and memory management controls on the /signalk/v1/access/requests endpoint. The server implementation stores all incoming access request objects in memory without:

1. Implementing a maximum queue size or request limit
2. Applying rate limiting to prevent request flooding
3. Setting timeouts to expire or remove stale request objects
4. Validating or throttling requests from individual sources

This design flaw allows attackers to continuously submit requests until the JavaScript heap is exhausted.

Attack Vector

The attack can be executed remotely over the network by any unauthenticated attacker with network access to the Signal K Server. The exploitation process involves sending a continuous stream of HTTP requests to the vulnerable endpoint /signalk/v1/access/requests. Since no authentication is required and there are no rate limits in place, an attacker can rapidly fill the server's memory allocation.

The attack is relatively straightforward to execute using common HTTP flooding tools or simple scripts that repeatedly POST to the access request endpoint. The server will continue accepting and storing these requests until memory exhaustion occurs, at which point the Node.js process crashes with a heap out of memory error.

Detection Methods for CVE-2025-68272

Indicators of Compromise

• Unusual spike in HTTP requests to the /signalk/v1/access/requests endpoint
• Rapid memory consumption growth in the Signal K Server Node.js process
• Server logs showing increasing numbers of access requests from single or multiple sources
• JavaScript heap out of memory errors in server logs or crash dumps

Detection Strategies

• Monitor HTTP request rates to the /signalk/v1/access/requests endpoint for anomalous patterns
• Configure alerting for memory utilization thresholds on systems running Signal K Server
• Implement network-level monitoring to detect request flooding patterns targeting the vulnerable endpoint
• Review server logs for repeated access request submissions that could indicate exploitation attempts

Monitoring Recommendations

• Set up real-time memory monitoring for Node.js processes running Signal K Server
• Configure network intrusion detection systems to alert on high-volume traffic to Signal K endpoints
• Implement log aggregation and analysis to identify patterns of endpoint abuse
• Monitor for unexpected Signal K Server process restarts or crashes

How to Mitigate CVE-2025-68272

Immediate Actions Required

• Upgrade Signal K Server to version 2.19.0 or later immediately
• If immediate upgrade is not possible, restrict network access to the Signal K Server using firewall rules
• Implement rate limiting at the network or reverse proxy level for the /signalk/v1/access/requests endpoint
• Monitor systems for signs of exploitation while preparing to patch

Patch Information

The vulnerability has been fixed in Signal K Server version 2.19.0. The fix implements proper bounds checking and rate limiting for the access request endpoint, preventing the unbounded memory allocation that enables this attack. Detailed patch information is available in the GitHub Release v2.19.0 and the GitHub Security Advisory GHSA-7rqc-ff8m-7j23.

Workarounds

• Deploy a reverse proxy (such as nginx or HAProxy) in front of Signal K Server with request rate limiting configured for the /signalk/v1/access/requests endpoint
• Use firewall rules to restrict access to Signal K Server to trusted networks or IP addresses only
• Implement network segmentation to isolate the Signal K Server from untrusted network segments
• Consider deploying intrusion prevention systems capable of detecting and blocking request flooding attacks

# Example nginx rate limiting configuration for Signal K Server
# Add to your nginx server block configuration
limit_req_zone $binary_remote_addr zone=signalk_access:10m rate=10r/s;

location /signalk/v1/access/requests {
    limit_req zone=signalk_access burst=20 nodelay;
    proxy_pass http://localhost:3000;
}