CVE-2026-70656: Checkmate: Regular Expression Denial of Service (ReDoS) via User-Controlled Regex in Monitor Advanced Matching
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.5.1 until 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression in the expectedValue field for advanced HTTP monitor matching. server/src/api/validation/monitorValidation.ts accepts the expression, and server/src/service/network/AdvancedMatcher.ts synchronously evaluates it against an attacker-controlled HTTP response body on the Node.js main event loop without a timeout or worker isolation, allowing catastrophic backtracking to freeze API endpoints, monitor checks, and WebSocket connections for all users. This issue is fixed in version 3.9.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.9.2 - Compensating control
If you cannot upgrade immediately, avoid using advanced HTTP monitor matching with matchMethod set to regex (so user-controlled expressions in expectedValue are not evaluated with regex backtracking on the Node.js main event loop).
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with administrator or superadministrator privileges can exploit it. Exploitation requires configuring an advanced HTTP monitor to use the regex match method and supplying a malicious regular expression in expectedValue.
What systems are affected?
Checkmate versions from 3.5.1 through 3.9.2 are identified as affected. The issue affects deployments where privileged users can create or modify advanced HTTP monitor matching rules.
What is the operational impact of a successful exploit?
A malicious expression can trigger catastrophic backtracking while being synchronously evaluated on the Node.js main event loop. This can freeze API endpoints, monitor checks, and WebSocket connections for all users.
How can I determine whether an instance may be exposed?
Review advanced HTTP monitor configurations for entries with matchMethod set to regex, particularly those whose expectedValue was created or modified by administrative users. Instances running an affected version and allowing such configurations may be exposed.
What should be done to remediate the issue?
Update Checkmate to version 3.9.2, which fixes the issue. If updating is not immediately possible, avoid using regex as the advanced HTTP monitor match method and review or remove existing user-controlled regex values.