Changes.Watch~ upgrade verdicts ~
Free digest
Research1 in 10 popular npm releases needed a hotfix

critical vulnerability

Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution

Fix availableCritical · CVSS 9.8

Published Oct 30, 2026 · updated Oct 30, 2026

What to do

  1. Upgrade to a fixed version: signalk-server 2.34.0, @signalk/resources-provider 1.5.3.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmsignalk-server8,434 downloads/week

Vulnerable versions
>= 2.0.0, < 2.34.0
Fixed in
2.34.0

Check your project: npm ls signalk-server --all

Is signalk-server@2.34.0 safe to install? See the upgrade verdict →

npm@signalk/resources-provider3,661 downloads/week

Vulnerable versions
>= 1.0.0, < 1.5.3
Fixed in
1.5.3

Check your project: npm ls @signalk/resources-provider --all

Is @signalk/resources-provider@1.5.3 safe to install? See the upgrade verdict →

What changed

  1. Oct 30, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

← All critical vulnerabilities