CVE-2026-55241
Received Received - Intake

Memory Exhaustion via Unrestricted File Upload in Checkmate

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart profileImage uploads through in-memory Multer parsing before registration validation, without file-size, file-count, or MIME-type limits in server/src/api/middleware/upload.ts. An unauthenticated attacker can submit concurrent oversized files that are buffered before invalid registration or invite-token checks reject the request, exhausting memory and crashing or destabilizing the backend. This issue is fixed in version 3.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-55241
EUVD
EUVD-2026-64037

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bluewave_labs checkmate 3.9.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a pre-authentication denial-of-service vulnerability in Checkmate's registration endpoint. The public POST /api/v1/auth/register route accepts multipart file uploads using in-memory Multer parsing without validating requests or enforcing upload limits. An attacker can send multiple very large profileImage files, forcing the server to buffer them in memory before rejecting the request. This exhausts RAM, causing crashes or instability.

Detection Guidance

Monitor for unusual memory usage spikes or backend crashes during file upload attempts. Check server logs for POST requests to /api/v1/auth/register with large multipart payloads. Use tools like netstat or ss to observe network connections during uploads.

Impact Analysis

An unauthenticated attacker can crash or destabilize the backend by sending oversized files, leading to service outages, performance degradation, or container OOM kills. Legitimate users may lose access to the service during attacks.

Compliance Impact

This vulnerability could lead to service instability or crashes due to memory exhaustion, potentially causing downtime or loss of availability for systems handling sensitive data. For GDPR, this may impact data processing integrity and availability requirements under Article 32. For HIPAA, it could affect the availability of electronic protected health information (ePHI) systems, violating the Security Rule's integrity and availability standards.

Mitigation Strategies

Upgrade to Checkmate version 3.9.1 or later. Implement server-side upload limits (file size, count) and strict MIME-type filtering. Temporarily disable public profile image uploads in registration until patched. Monitor memory usage and backend stability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55241. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart