signalk-server

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Behind the package

View on npm

Explore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.

An implementation of a [Signal K](http://signalk.org) server for boats.

Latest release2.35.1

Declared licenseApache-2.0

Listed maintainerstkurki, sbender

Runtime dependencies64

Install-time scriptsNone declared

Integrity metadataRecorded by registry

Attestation metadataRecorded, not verified here

Registry deprecationNot marked deprecated

Direct dependencies of 2.35.1

ms^2.1.2
ws^8.17.0
ncp^2.0.0
ora^5.4.1
cors^2.8.6
jose^6.2.3
uuid^8.3.2
chalk^3.0.0
clear^0.1.0
debug^4.4.3
split^1.0.1
busboy^1.6.0
cookie^0.7.0
geolib^3.3.14
helmet^8.2.0
lodash^4.18.1
marked^17.0.6
mathjs^15.2.0
moment^2.30.1
morgan^1.11.0
primus^7.3.5
semver^7.8.5
undici^7.28.0
baconjs^3.0.23
express^4.22.2
prompts^2.4.2
unified^11.0.5
archiver^7.0.1
as-fetch^2.1.4
bcryptjs^2.4.3
minimist^1.2.8
unzipper^0.12.3
stat-mode^1.0.0
json-patch^0.7.0
remark-gfm^4.0.1
selfsigned^2.4.1
body-parser^1.20.5
compression^1.8.1
esm-resolve^1.0.11
errorhandler^1.5.2
jsonwebtoken^9.0.3
rehype-parse^9.0.1
cookie-parser^1.4.7
openid-client^6.8.4
rehype-remark^10.0.1
command-exists^1.2.9
path-to-regexp^0.1.12
get-folder-size^5.0.0
@signalk/streams^6.10.0
remark-stringify^11.0.0
api-schema-builder^2.0.11
express-rate-limit^8.5.2
swagger-ui-express^4.6.3
@astronautlabs/mdns^1.0.10
@signalk/server-api^2.35.0
express-static-gzip^3.0.1
@signalk/n2k-signalk>=4.1.0-beta
file-timestamp-stream^2.2.4
@assemblyscript/loader^0.28.19
@signalk/path-metadata^1.0.3
@signalk/signalk-schema1.0.x
@signalk/course-provider^1.4.0
@signalk/nmea0183-signalk^3.20.0
@signalk/resources-provider^1.5.3

Fetched 31/10/2026, 04:26:25 UTC · Original registry metadata

Release history

Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

critical9.8

GHSA-4xm8-rg9h-jhq2No CVE assignedFix available

Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution

npm / signalk-server npm / @signalk/resources-provider

5 hours ago

signalk-server npm

Affected range	Recorded fix
From 2.0.0 before 2.34.0Semantic versions	2.34.0

Version evidence: OSV · GHSA-4xm8-rg9h-jhq2

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.0.0"
        },
        {
          "fixed": "2.34.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

critical9.8

CVE-2026-118690

Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

SignalK · signalk-server

2 days ago

medium4.2

CVE-2026-115752Fix available

Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon

npm / signalk-server

8 days ago

signalk-server npm

Affected range	Recorded fix
From 2.28.0-beta.2 before 2.34.0Semantic versions	2.34.0

Version evidence: OSV · GHSA-7wpf-ch8f-5f4x

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.28.0-beta.2"
        },
        {
          "fixed": "2.34.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}