Signal K Server versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack in WebSocket subscription handling logic. Attackers can inject unescaped regex metacharacters into the context parameter, causing catastrophic backtracking in the Node.js event loop. This results in complete server unresponsiveness with 100% CPU usage. The vulnerability affects boat hub servers running Signal K Server. Version 2.25.0 contains the fix for this critical DoS vulnerability.