Description

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart profileImage uploads through in-memory Multer parsing before registration validation, without file-size, file-count, or MIME-type limits in server/src/api/middleware/upload.ts. An unauthenticated attacker can submit concurrent oversized files that are buffered before invalid registration or invite-token checks reject the request, exhausting memory and crashing or destabilizing the backend. This issue is fixed in version 3.9.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-21T18:16:48.790Z",
  "pubdate": "2026-08-21T18:16:48.790Z",
  "executiveSummary": "A denial of service vulnerability exists in Checkmate prior to version 3.9.1, allowing unauthenticated attackers to crash or destabilize the backend server.\nThe vulnerability arises due to the handling of multipart profileImage uploads within the public POST /api/v1/auth/register route.\nBecause the application processes uploads via in-memory Multer parsing before enforcing registration validation, invite-token checks, file-size limits, file-count limits, or MIME-type restrictions, attackers can submit concurrent oversized files.\nThis behavior forces the Node.js backend to exhaust available memory buffering the malicious payloads.\nThe risk implication is critical availability degradation, as an external attacker can repeatedly trigger out-of-memory crashes with minimal effort.\nExploitation requires network access to the registration endpoint but does not require authentication or prior privileges.",
  "technicalDetails": "The root cause of the vulnerability lies in improper request validation ordering and the lack of resource constraints within the file upload middleware. Specifically, the vulnerable component is located in server/src/api/middleware/upload.ts and utilized by the public POST /api/v1/auth/register route defined in server/src/api/routes/authRoutes.ts.\nWhen an HTTP POST request is dispatched to the registration endpoint, the Multer middleware intercepts the multipart/form-data payload and buffers uploaded files directly into server memory. Critically, this buffering operation executes prior to any application-level logic verifying registration parameters, validating invite tokens, or enforcing constraints on file size, file count, and MIME types.\nAn unauthenticated attacker can exploit this architectural flaw by initiating concurrent HTTP requests containing massively oversized files directed at the registration endpoint. As the server processes these concurrent requests, the Node.js runtime allocates contiguous memory blocks to hold the incoming data streams in memory.\nBecause validation checks that would otherwise reject unauthorized or malformed registration attempts occur strictly after the upload middleware completes its execution, the backend is forced to consume memory for payloads that will ultimately be discarded.\nBy saturating the server with concurrent oversized payloads, the attacker triggers an out-of-memory condition. This results in the abrupt termination of the Node.js process, causing a denial of service for legitimate users relying on Checkmate for real-time server hardware monitoring, uptime tracking, and incident visualization.\nThe affected product is Checkmate in versions prior to 3.9.1. The attack is network-exposed, completely unauthenticated, and requires no specialized privileges beyond the ability to reach the public registration interface."
}