Signal K Server contains a regular expression denial‑of‑service flaw that allows an unauthenticated attacker to inject unescaped regex metacharacters into the context parameter of a WebSocket subscription. The injected characters cause the Node.js event loop to perform catastrophic backtracking against long identifiers such as the server’s own UUID, resulting in CPU saturation and a total denial of service to all further API and socket requests.

The vulnerability affects the Signal K Server application provided by SignalK (signalk-server). All releases earlier than version 2.25.0 are impacted; version 2.25.0 and later contain the fix.

With a CVSS score of 7.5 the vulnerability is considered high severity, but the EPSS score is reported as less than 1% and the issue is not listed in the CISA KEV catalog, indicating no publicly known exploitation yet. The likely attack vector is remote, as any entity that can connect to the server’s WebSocket endpoint can craft a malicious subscription path without authentication. Once triggered, the server’s CPU can reach 100 % and the process becomes completely unresponsive to additional traffic.