Signal K Server 2.37.0 arrived on 7 November with new vessel-data features and two accompanying security advisories. However, one advisory contradicts itself about the fix, so operators should read beyond its version table before treating the security position as settled.
For earlier context in the same update chain, see our Signal K Server 2.34.0 security coverage. That article covers earlier advisories, not the two issues discussed here.
WebSocket advisory gives conflicting fix information
The project rates GHSA-qf2w-mm2p-jmg9 High. It describes a regular-expression denial-of-service problem in WebSocket subscription matching that can stall the server, including its APIs and other clients.
The advisory header lists npm package versions ≤2.34.0 as affected and 2.37.0 as patched. However, its narrative names 2.34.0 as the latest release checked and still says “Fix status: not fixed”. Those statements conflict; the advisory does not explain the discrepancy. Neither that table nor this report independently establishes that 2.35 or 2.36 is safe, and we cannot present the 2.37.0 remedy as settled while the official text disagrees.
In the default configuration described by the advisory, anonymous clients can both subscribe and write data. By contrast, token-secured deployments distinguish permissions: a client with read access can register the problematic subscription, while a client with write access can supply the triggering data. Read access alone therefore does not describe the complete attack path.
As an interim precaution, the advisory recommends authentication for trusted clients, but says this does not remove the underlying flaw or protect against an authenticated client. Accordingly, operators should review both client permissions and network exposure rather than rely on a login alone.
Docker advisory requires rebuilt base images
Meanwhile, GHSA-2v85-4p6q-957v rates a Docker-only issue Moderate. Its header lists signalk/signalk-server images through 2.36.0 as affected and 2.37.0 as patched, including the -core variants in its description.
The advisory says elevated permissions on the container’s date utility let plugins read root-only files. Moreover, privileged containers with host devices exposed can extend that access to host disks. This Docker advisory does not cover non-Docker installations.
Crucially, the Docker advisory, not the server release notes, says the fix reaches server images only after the project rebuilds its base images. We have not verified rebuilt Docker Hub image availability. Therefore, Docker operators should confirm that their replacement image incorporates that rebuild, rather than assume a version label alone proves it.
New features beyond security
Alongside the advisories, the 2.37.0 release notes add monohull, catamaran and trimaran hull types, a standard logentries resource and the Course Provider plugin package.
The release also corrects cached-value delivery with security enabled, several unit preferences, vessel identification without an MMSI, stale heading in CCRP correction and radar API documentation alignment.
For standalone installations, check the installed version against each advisory’s stated scope and follow the project’s update guidance. For Victron Venus OS Large, use Victron’s supported update route rather than install an upstream server into the appliance. This report makes no claim about the Signal K version in current Victron firmware.
