Executive brief
Checkmate is an open-source server monitoring platform that tracks uptime and performance metrics. An authenticated administrator can trigger a Regular Expression Denial of Service (ReDoS) attack by configuring a malicious regex pattern in HTTP monitors, causing the application to freeze and become unresponsive to all users.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) affecting regex-based HTTP monitor matching in Checkmate versions 3.5.1 through 3.9.1. Vulnerable code in server/src/api/validation/monitorValidation.ts accepts user-supplied regex expressions, which are then evaluated synchronously by AdvancedMatcher.ts against attacker-controlled HTTP response bodies on Node.js's main event loop without timeout or worker isolation. Catastrophic backtracking in the regex engine causes the thread to hang indefinitely, freezing API endpoints, monitor checks, and WebSocket connections for all users. Authentication as admin or superadmin is required to exploit this vulnerability. The issue is resolved in version 3.9.2 by switching to the re2 regex library and tightening validation rules.
Affected products
- Blue Wave Labs Checkmate 3.5.1 to 3.9.1
Timeline
- 2026-08-21: disclosed
- 2026-08-21: patched: Version 3.9.2 resolves the vulnerability