CVE-2026-70656
Received Received - Intake

Authenticated Admin Remote Code Execution via Regex in Checkmate

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.5.1 until 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression in the expectedValue field for advanced HTTP monitor matching. server/src/api/validation/monitorValidation.ts accepts the expression, and server/src/service/network/AdvancedMatcher.ts synchronously evaluates it against an attacker-controlled HTTP response body on the Node.js main event loop without a timeout or worker isolation, allowing catastrophic backtracking to freeze API endpoints, monitor checks, and WebSocket connections for all users. This issue is fixed in version 3.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-70656
EUVD
EUVD-2026-64038

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
checkmate checkmate From 3.5.1 (inc) to 3.9.2 (inc)
checkmate checkmate 3.9.2
bluewave-labs checkmate From 3.5.1 (inc) to 3.8.1 (inc)
bluewave-labs checkmate 3.9.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-70656 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Checkmate monitoring tool. An authenticated admin or superadmin can exploit this by creating a monitor with a malicious regular expression in the expectedValue field when the matchMethod is set to 'regex'. This causes catastrophic backtracking when the regex is evaluated against the HTTP response body, freezing the entire Checkmate server due to synchronous execution on the Node.js main event loop with no timeout or worker thread isolation.

Detection Guidance

Check for Checkmate versions between 3.5.1 and 3.8.1. Inspect monitor configurations for regex matchMethod with complex expectedValue patterns. Look for frozen API endpoints, monitor checks, or WebSocket connections during regex evaluation.

Impact Analysis

This vulnerability can freeze all API endpoints, monitor checks, and WebSocket connections for all users. A single malicious monitor can block the entire Checkmate server, disrupting monitoring and incident response capabilities.

Compliance Impact

This vulnerability primarily impacts availability by allowing denial-of-service attacks through regex-based resource exhaustion. While not directly violating GDPR or HIPAA, prolonged service unavailability could lead to violations of data processing timelines or access controls. The lack of input validation for regex patterns may also expose systems to unauthorized data access if malicious patterns bypass monitoring.

Mitigation Strategies

Upgrade to Checkmate v3.9.2 or later. Remove or disable monitors using regex matchMethod with complex expectedValue patterns. Implement network monitoring for unusual API freeze patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70656. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart