CVE-2026-55241: Checkmate Memory Exhaustion DoS Vulnerability

CVE-2026-55241 Overview

Checkmate is an open-source, self-hosted monitoring tool that tracks server hardware, uptime, response times, and incidents. Versions prior to 3.9.1 expose the public POST /api/v1/auth/register route to an unauthenticated resource exhaustion attack. The endpoint passes multipart profileImage uploads through in-memory Multer parsing before registration validation runs. The upload middleware in server/src/api/middleware/upload.ts lacks file-size, file-count, and MIME-type limits. Concurrent oversized uploads buffer entirely in memory before the request is rejected, exhausting backend memory and crashing the service. The issue is tracked as [CWE-400] Uncontrolled Resource Consumption and is fixed in version 3.9.1.

Critical Impact
Unauthenticated attackers can crash or destabilize the Checkmate backend by submitting concurrent oversized multipart uploads to the registration endpoint.

Affected Products

Checkmate (bluewave-labs) versions prior to 3.9.1
Component: server/src/api/routes/authRoutes.ts
Component: server/src/api/middleware/upload.ts

Discovery Timeline

2026-08-21 - CVE-2026-55241 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55241

Vulnerability Analysis

The vulnerability is an unauthenticated denial-of-service condition in Checkmate's registration endpoint. The public POST /api/v1/auth/register route accepts multipart form data containing a profileImage field. Multer parses these uploads into memory before the route handler evaluates registration input or invite-token validity. Because the upload middleware defines no limits.fileSize, no limits.files, and no fileFilter, arbitrarily large payloads are buffered before any authentication or validation logic executes. An attacker who submits many concurrent oversized uploads forces the Node.js process to allocate memory faster than requests are rejected, eventually exhausting the heap and crashing the backend.

Root Cause

The root cause is misordered middleware in combination with an unconstrained Multer configuration. Upload parsing runs prior to input validation and token verification, and the Multer instance is created without size, count, or MIME-type constraints. Any body posted to the public registration route is fully buffered in memory regardless of whether registration is enabled or the invite token is valid.

Attack Vector

Exploitation requires only network access to the Checkmate server and no credentials. The attacker sends concurrent multipart/form-data requests to /api/v1/auth/register containing a large profileImage part. Each request consumes RAM until the process runs out of memory or becomes unresponsive.

typescript

// Security patch: server/src/api/middleware/upload.ts (v3.9.1)
// Introduces file-size, file-count, and MIME-type limits.
import multer from "multer";
import { AppError } from "@/utils/AppError.js";
import { ImageMimeTypes, MAX_IMAGE_SIZE_BYTES } from "@/types/upload.js";

// Reusable multer instance for handling image uploads
const imageUpload = multer({
	limits: {
		fileSize: MAX_IMAGE_SIZE_BYTES,
		files: 1,
	},
	fileFilter: (_req, file, cb) => {
		if (!(ImageMimeTypes as readonly string[]).includes(file.mimetype)) {
			cb(
				new AppError({
					status: 415,
					message: "File must be a valid image (jpeg, jpg, or png)",
					service: "uploadMiddleware",
					method: "fileFilter",
				})
			);
			return;
		}
		cb(null, true);
	},
});

export { imageUpload };

Source: GitHub Checkmate Commit 091c36c

Detection Methods for CVE-2026-55241

Indicators of Compromise

Repeated unauthenticated POST requests to /api/v1/auth/register with large Content-Length values and multipart/form-data bodies.
Sudden growth of Node.js resident memory on the Checkmate backend followed by process restarts or out-of-memory (OOM) kills.
Spikes of concurrent registration attempts from a single source or small set of sources without corresponding new accounts created.

Detection Strategies

Alert on HTTP request bodies exceeding a reasonable profile-image size (for example, several megabytes) sent to the registration route.
Correlate registration endpoint traffic against successful account creations; a high ratio of failed or unfinished registrations indicates abuse.
Monitor container or host OOM events and Node.js heap metrics for the Checkmate service.

Monitoring Recommendations

Enable web application firewall (WAF) or reverse-proxy request-body size limits in front of Checkmate and log rejections.
Ingest Checkmate application logs and error events into a centralized logging platform to correlate crashes with upload activity.
Track per-source rate metrics on /api/v1/auth/register and alert on bursts of concurrent multipart uploads.

How to Mitigate CVE-2026-55241

Immediate Actions Required

Upgrade Checkmate to version 3.9.1 or later, which enforces file-size, file-count, and MIME-type limits on uploads.
Restrict network exposure of the Checkmate backend so the registration endpoint is not reachable from untrusted networks where possible.
Enforce a request body size limit at the reverse proxy or WAF layer for /api/v1/auth/register.

Patch Information

The fix is available in Checkmate release v3.9.1. The patch introduces a dedicated imageUpload middleware backed by Multer with fileSize and files limits and a fileFilter that rejects non-image MIME types. Error handling was updated in server/src/api/middleware/handleErrors.ts to return HTTP 413 for LIMIT_FILE_SIZE and HTTP 400 for other Multer errors. See the GitHub Security Advisory GHSA-9xvg-x28f-m78m for full details.

Workarounds

Place Checkmate behind a reverse proxy (nginx, Caddy, or similar) and enforce a low client_max_body_size for the registration route.
Rate-limit unauthenticated requests to /api/v1/auth/register to reduce the impact of concurrent upload floods.
Disable public registration if not required, so the attack surface is limited to authenticated administrators.

bash

# Example nginx configuration limiting body size and rate for the registration route
location = /api/v1/auth/register {
    client_max_body_size 2m;
    limit_req zone=register_zone burst=5 nodelay;
    proxy_pass http://checkmate_backend;
}

# Define the rate-limit zone in the http {} block
# limit_req_zone $binary_remote_addr zone=register_zone:10m rate=5r/m;