CVE-2026-55241: Checkmate: Pre-auth Denial of Service via File Upload on Registration
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart profileImage uploads through in-memory Multer parsing before registration validation, without file-size, file-count, or MIME-type limits in server/src/api/middleware/upload.ts. An unauthenticated attacker can submit concurrent oversized files that are buffered before invalid registration or invite-token checks reject the request, exhausting memory and crashing or destabilizing the backend. This issue is fixed in version 3.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Checkmateto a version that resolves this vulnerability.Fixed in 3.9.1
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Checkmate deployments running versions before 3.9.1 are exposed if the public registration endpoint is reachable. The affected route can be attacked without authentication.
What does an attacker need to do to trigger the issue?
An attacker can send concurrent multipart registration requests containing oversized profile-image uploads. The files are buffered in memory before registration validation or invite-token checks reject the requests.
Does disabling registration or requiring invite tokens prevent exploitation?
No. Registration validation and invite-token checks occur after the multipart upload has already been parsed and buffered in memory.
What is the remediation?
Upgrade Checkmate to version 3.9.1, which fixes the issue.