Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

Description

[Note] This is a separate issue from the RCE vulnerability (State Pollution) currently being patched. While related to tokensecurity.js, it involves different endpoints and risks.

Recommendation

Update the signalk-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.19.0
• Patched version(s): 2.19.0

References

• GHSA-fpf5-w967-rr2m
• CVE-2025-68273
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) - CVE-2025-66398
• Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding - CVE-2025-68272
• Signal K Server Vulnerable to Access Request Spoofing - CVE-2025-69203
• Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package - CVE-2025-68619

Tags:

npm

signalk-server