7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68272

CVE-2025-68272: Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding

Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (/signalk/v1/access/requests). This causes a "JavaScript heap out of memory" error due to unbounded in-memory storage of request objects. Version 2.19.0 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68272

CVE-2025-68272:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
signalk-server	npm	< 2.19.0	2.19.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service in Signal K Server, where an unauthenticated attacker can crash the server by flooding the /signalk/v1/access/requests endpoint. This leads to a 'JavaScript heap out of memory' error.

The analysis of the provided patch (commit 55e3574d8266fbc0ed8e453ad4557073541566f5) reveals two key functions that were modified to fix the vulnerability:

app.post</signalk/v1/access/requests> in src/serverroutes.ts: This is the entry point for the attack. The original code did not have any rate limiting or payload size checks. An attacker could send an unlimited number of requests, including ones with large bodies, to be processed. The patch introduces express-rate-limit middleware (apiLimiter) to restrict the number of requests from a single IP and adds a check to reject request bodies larger than 10KB.
requestAccess in src/tokensecurity.js: This function is called by the route handler to process the access request. The vulnerability lies in its failure to limit the number of pending requests stored in memory. Each request was added to an in-memory object without any bounds. The patch adds a crucial check to limit the number of pending requests to 100. If this limit is reached, new requests are rejected, preventing the server from running out of memory.

During an exploit, a runtime profiler would show a high number of calls to the anonymous route handler in src/serverroutes.ts, which in turn calls the requestAccess function. These two functions are central to the vulnerability, as one provides the open door and the other contains the flawed logic that leads to resource exhaustion.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.