CVE-2026-55241
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Checkmate before version 3.9.1 has a memory exhaustion vulnerability in the public registration endpoint. An unauthenticated attacker can send multiple concurrent oversized files that are buffered before validation, leading to memory exhaustion and backend crash.
Risk Assessment
The attack can cause denial of service (DoS) and system instability, affecting infrastructure monitoring.
Recommendation
Update Checkmate to version 3.9.1 or later, which includes the fix.
Other vulnerabilities in Checkmate
See all- CVE-2026-36102Low risk· EPSS 12%
An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.
- CVE-2026-71862High
Checkmate from version 3.3.0 until 3.9.2, when the global showURL setting is enabled, causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects, including the secret field used as an HTTP Authorization credential, even though it is not displayed in the UI.
- CVE-2026-70656Medium
In Checkmate versions from 3.5.1 to 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression in the expectedValue field for advanced HTTP monitor matching. The expression is synchronously evaluated on the Node.js main event loop without a timeout or worker isolation, allowing catastrophic backtracking to freeze API endpoints, monitor checks, and WebSocket connections for all users. This issue is fixed in version 3.9.2.
- CVE-2026-72588Medium
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.
Original NVD description (English source)
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart profileImage uploads through in-memory Multer parsing before registration validation, without file-size, file-count, or MIME-type limits in server/src/api/middleware/upload.ts. An unauthenticated attacker can submit concurrent oversized files that are buffered before invalid registration or invite-token checks reject the request, exhausting memory and crashing or destabilizing the backend. This issue is fixed in version 3.9.1.