signalk-server vulnerabilities
CVEs whose affected-version data names the signalk-server package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-115752Medium· 4.2Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can m…
▾ SunlitSignalK · signalk-serverEPSS 0.18%via CVEORG
CVE-2026-55591Medium· 5.8PoCSignal K Server is a server application that runs on a central hub in a boat
Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalK…
▾ TwilightSignalK · signalk-serverEPSS 0.30%via NVD