signalk-server

An implementation of a [Signal K](http://signalk.org) server for boats.

Latest 2.33.0

88%

Total Score

healthy

Healthy release backed by active maintenance, frequent releases, and broad contributor activity; CI workflow hygiene is the main caveat.

Are you affected? Scan for Free

Health Score Breakdown

Dependency profile

The package has 63 runtime dependencies, which is a substantial dependency surface for a server application and modestly increases maintenance exposure, but the profile is consistent with its broad functionality.

Workflow audit

All nine workflows were analyzed with no untrusted checkouts or script injections, but all 69 action references are unpinned, one release workflow uses an archived action, and high-confidence adhoc package installs reduce CI reproducibility. The low-confidence cache findings and medium-confidence template-injection findings are hygiene concerns rather than standalone severe risks.

Vulnerabilities

Title	Versions	Severity
CVE-2026-55591 signalk-server is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.0 - 2.27.0.	0.0.0 - 2.27.0	Medium
CVE-2026-41893 signalk-server is vulnerable to Improper Restriction of Excessive Authentication Attempts in versions 0.0.0 - 2.24.0.	0.0.0 - 2.24.0	High
CVE-2026-39320 signalk-server is vulnerable to Uncontrolled Resource Consumption in versions 0.0.0 - 2.25.0.	0.0.0 - 2.25.0	High
CVE-2026-34083 signalk-server is vulnerable to Origin Validation Error in versions 2.20.0 - 2.24.0.	2.20.0 - 2.24.0	Medium
CVE-2026-33951 signalk-server is vulnerable to Improper Access Control in versions 0.0.0 - 2.24.0-beta.1.	0.0.0 - 2.24.0-beta.1	High