CVE-2026-70656: Checkmate ReDoS Denial of Service Vulnerability

CVE-2026-70656 Overview

Checkmate is an open-source, self-hosted server monitoring tool that tracks hardware, uptime, response times, and incidents. Versions from 3.5.1 through 3.9.1 contain a Regular Expression Denial of Service (ReDoS) vulnerability [CWE-1333] in the advanced HTTP monitor matching feature. An authenticated admin or superadmin can set matchMethod to regex and supply a malicious expression in the expectedValue field. The server evaluates this expression synchronously on the Node.js main event loop without a timeout or worker isolation, causing catastrophic backtracking that freezes API endpoints, monitor checks, and WebSocket connections for all users. The issue is fixed in version 3.9.2.

Critical Impact

A single authenticated administrator can freeze the entire Checkmate instance for all users by submitting a crafted regular expression paired with an attacker-controlled HTTP response body.

Affected Products

• Checkmate 3.5.1 through 3.9.1 (bluewave-labs/Checkmate)
• server/src/api/validation/monitorValidation.ts — accepts unrestricted regex input
• server/src/service/network/AdvancedMatcher.ts — synchronously evaluates regex on the main event loop

Discovery Timeline

• 2026-08-21 - CVE-2026-70656 published to NVD
• 2026-08-21 - Last updated in NVD database
• v3.9.2 - bluewave-labs releases patched version referenced in GitHub Security Advisory GHSA-4c6j-p2cv-wf56

Technical Details for CVE-2026-70656

Vulnerability Analysis

The vulnerability is a ReDoS flaw in Checkmate's advanced HTTP monitor matcher. When a monitor is configured with matchMethod: "regex", the AdvancedMatcher executes the operator-supplied pattern against the HTTP response body returned by the monitored target. The execution uses Node.js's built-in RegExp engine, which uses a backtracking NFA. A pathological pattern combined with a crafted response body triggers exponential-time backtracking. Because the evaluation runs on the main event loop with no timeout and no worker isolation, all concurrent API, monitor, and WebSocket work stalls until the regex completes.

Root Cause

Two defects combine to produce the flaw. First, monitorValidation.ts accepts arbitrary regex strings from the API without complexity or safety checks. Second, AdvancedMatcher.ts compiles and executes those regexes synchronously with the standard JavaScript engine, which is vulnerable to catastrophic backtracking. The response body being matched is attacker-controlled at the network level, allowing an operator with monitor-management rights to point a monitor at a server that returns tuned payloads.

Attack Vector

Exploitation requires an authenticated admin or superadmin account. The attacker creates or edits an advanced HTTP monitor, sets matchMethod to regex, and supplies a pathological pattern such as one containing nested quantifiers. They point the monitor at an HTTP endpoint they control that returns a body designed to trigger backtracking. When Checkmate polls the endpoint, the regex evaluation blocks the event loop, and API responses, WebSocket messages, and other monitor checks stop until the process is restarted or the regex completes.

// Patch: server/src/service/network/AdvancedMatcher.ts
 import { Monitor } from "@/domain/monitors/monitor.types.js";
 import jmespath from "jmespath";
+import RE2 from "re2";
 type JmesPath = typeof jmespath;
 
 export interface IAdvancedMatcher {

// Patch: server/src/api/validation/monitorValidation.ts
 import { z } from "zod";
+import RE2 from "re2";
 import { booleanCoercion, dnsHostnameRegex, dnsServerValidation } from "./shared.js";
 import { GeoContinents } from "@/domain/geo-checks/geo-check.type.js";

Source: Checkmate commit 0df71d6 and commit adba252. The fix replaces Node's built-in RegExp with the re2 library, which uses a linear-time engine that is immune to catastrophic backtracking, and tightens validation of user-supplied patterns.

Detection Methods for CVE-2026-70656

Indicators of Compromise

• Checkmate API endpoints becoming unresponsive or exhibiting long latency without matching CPU load from external traffic
• WebSocket disconnections affecting all connected clients simultaneously
• Monitor check queues stalling with no completed checks logged for extended periods
• Advanced HTTP monitors configured with matchMethod: regex and unusually complex expectedValue patterns (nested quantifiers, alternations with overlap)
• Monitors pointing to untrusted or newly-added external hostnames returning large or repetitive response bodies

Detection Strategies

• Audit the monitors collection for records where matchMethod equals regex and inspect each expectedValue for known ReDoS patterns such as (a+)+, (a|a)+, or deeply nested groups.
• Track Node.js event loop lag on the Checkmate server; sustained lag above a few hundred milliseconds correlates with regex-driven stalls.
• Review admin and superadmin audit logs for recent monitor create or update operations that changed matchMethod to regex.

Monitoring Recommendations

• Alert on Checkmate server process CPU pinned to 100% on a single core while inbound HTTP traffic is low.
• Alert on gaps in monitor check timestamps that exceed the configured polling interval.
• Forward Checkmate application and access logs to a centralized log platform and alert on repeated 5xx responses or WebSocket resets across sessions.

How to Mitigate CVE-2026-70656

Immediate Actions Required

• Upgrade Checkmate to version 3.9.2 or later, which switches regex evaluation to the re2 library.
• Review all existing advanced HTTP monitors and remove or rewrite any regex matchers that use user-authored patterns.
• Rotate credentials for any admin or superadmin accounts whose activity cannot be fully accounted for in the audit log.
• Restrict admin and superadmin role assignments to the minimum set of operators required.

Patch Information

The fix ships in Checkmate release v3.9.2. Relevant commits: 0df71d6 hardens AdvancedMatcher.ts by wrapping regex execution with re2; adba252 and d5ec293 tighten regex validation in monitorValidation.ts. Additional context is available in GHSA-4c6j-p2cv-wf56.

Workarounds

• If upgrading is not immediately possible, disable use of matchMethod: regex on all advanced HTTP monitors and use contains or equals matchers instead.
• Restrict admin and superadmin API access to trusted networks using a reverse proxy or firewall rules.
• Run the Checkmate process under a supervisor that restarts it when event loop lag or CPU exceeds a defined threshold to limit downtime from any residual stalls.

# Upgrade Checkmate to the patched release
docker pull bluewavelabs/checkmate:3.9.2
docker compose down
docker compose up -d

# Verify installed version
docker exec checkmate-server node -e "console.log(require('./package.json').version)"