Description

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.5.1 until 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression in the expectedValue field for advanced HTTP monitor matching. server/src/api/validation/monitorValidation.ts accepts the expression, and server/src/service/network/AdvancedMatcher.ts synchronously evaluates it against an attacker-controlled HTTP response body on the Node.js main event loop without a timeout or worker isolation, allowing catastrophic backtracking to freeze API endpoints, monitor checks, and WebSocket connections for all users. This issue is fixed in version 3.9.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-21T18:16:50.277Z",
  "pubdate": "2026-08-21T18:16:50.277Z",
  "executiveSummary": "Checkmate versions 3.5.1 through 3.9.2 are susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability affecting advanced HTTP monitor matching.\nThe vulnerability allows an authenticated administrator or superadmin to supply a maliciously crafted regular expression that triggers catastrophic backtracking during evaluation.\nExploitation of this flaw enables an attacker to completely freeze the Node.js main event loop without worker isolation or execution timeouts.\nThe resulting denial of service disrupts all API endpoints, monitor checks, and real-time WebSocket connections across the entire application for all users.\nPrerequisites for exploitation include administrative authentication privileges and access to configure advanced HTTP monitor matching settings within the affected self-hosted instance.",
  "technicalDetails": "The root cause of the vulnerability lies in the unsafe synchronous evaluation of user-supplied regular expressions against attacker-controlled HTTP response bodies on the main Node.js event loop.\nSpecifically, the input validation logic within server/src/api/validation/monitorValidation.ts accepts the matchMethod parameter set to regex along with a malicious expression provided in the expectedValue field.\nThis expression is subsequently processed and evaluated by server/src/service/network/AdvancedMatcher.ts without any execution timeout mechanisms or sandboxed worker thread isolation.\nWhen an administrator crafts a pathological regular expression designed to induce catastrophic backtracking, the synchronous processing blocks the single-threaded Node.js event loop entirely.\nThe attack flow proceeds as follows: 1) The attacker authenticates with admin or superadmin privileges; 2) The attacker configures an advanced HTTP monitor utilizing the regex matchMethod; 3) The attacker supplies a crafted ReDoS payload in the expectedValue field; 4) The application triggers the monitor check against an attacker-controlled HTTP endpoint; 5) AdvancedMatcher.ts synchronously executes the vulnerable regular expression against the returned response body; 6) Catastrophic backtracking consumes CPU resources indefinitely, halting event loop processing and freezing the application.\nAffected versions span from 3.5.1 up to, but not including, the patched version 3.9.2 where the issue is resolved."
}