CVE-2026-70656
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
In Checkmate versions from 3.5.1 to 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression in the expectedValue field for advanced HTTP monitor matching. The expression is synchronously evaluated on the Node.js main event loop without a timeout or worker isolation, allowing catastrophic backtracking to freeze API endpoints, monitor checks, and WebSocket connections for all users. This issue is fixed in version 3.9.2.
Risk Assessment
An attacker can cause a denial of service (DoS) by freezing key functionalities of the tool, impacting the availability of monitoring and incident response for all users.
Recommendation
Upgrade Checkmate to version 3.9.2 or later, which includes a fix for the catastrophic backtracking vulnerability.
Other vulnerabilities in Checkmate
See all- CVE-2026-36102Low risk· EPSS 12%
An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.
- CVE-2026-71862High
Checkmate from version 3.3.0 until 3.9.2, when the global showURL setting is enabled, causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects, including the secret field used as an HTTP Authorization credential, even though it is not displayed in the UI.
- CVE-2026-55241High
Checkmate before version 3.9.1 has a memory exhaustion vulnerability in the public registration endpoint. An unauthenticated attacker can send multiple concurrent oversized files that are buffered before validation, leading to memory exhaustion and backend crash.
- CVE-2026-72588Medium
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.
Original NVD description (English source)
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.5.1 until 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression in the expectedValue field for advanced HTTP monitor matching. server/src/api/validation/monitorValidation.ts accepts the expression, and server/src/service/network/AdvancedMatcher.ts synchronously evaluates it against an attacker-controlled HTTP response body on the Node.js main event loop without a timeout or worker isolation, allowing catastrophic backtracking to freeze API endpoints, monitor checks, and WebSocket connections for all users. This issue is fixed in version 3.9.2.