Executive brief
Checkmate is an open-source server monitoring tool that tracks hardware, uptime, and incidents in real-time. An unauthenticated attacker can send oversized profile image files to the public registration endpoint, exhausting the server's memory and crashing the monitoring service before validation checks reject the request. This prevents legitimate users from monitoring their infrastructure.
Technical details
The vulnerability is a denial-of-service flaw in the POST /api/v1/auth/register route caused by insufficient file-upload validation. The Multer middleware in server/src/api/middleware/upload.ts lacks file-size, file-count, and MIME-type limits, buffering multipart form data (profileImage uploads) in memory before registration validation or invite-token checks are performed. An unauthenticated attacker can submit concurrent oversized files to exhaust memory and crash or destabilize the backend. The attack requires network access to the public registration endpoint but no authentication or user interaction. The vulnerability was fixed in version 3.9.1 by implementing proper file-upload constraints in the middleware.
Affected products
- Bluewave Labs Checkmate before 3.9.1
Timeline
- 2026-08-21: disclosed
- 2026-07-03: patched: v3.9.1 released