Checkmate CVE-2026-55241

No authentication or prior account is required - POST /api/v1/auth/register is a fully public endpoint. The vulnerable code path is triggered by any multipart form submission that includes a profileImage field, regardless of whether the registration data is valid or an invite token is present; Multer parsing occurs before those checks. Exploitation requires only HTTP network connectivity to the Checkmate backend port. Limiting factors: deployments accessible only via private network, VPN, or restricted firewall rules have materially reduced exposure; upstream reverse proxies with body-size limits or aggressive rate limiting reduce but do not eliminate the risk against the unpatched application. There is no specific platform, OS, or non-default configuration prerequisite - any exposed Checkmate instance prior to v3.9.1 is vulnerable.

The CVSS 3.1 score of 7.5 High with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the risk profile. The attack is trivially executable over the network with no authentication, no user interaction, and no special configuration - an attacker needs only HTTP connectivity to the registration endpoint. The availability impact is rated High because memory exhaustion crashes or destabilizes the entire backend process, taking the monitoring platform offline. There is no confidentiality or integrity impact. EPSS data was not provided in the input, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis. Despite the low operational sophistication required, real-world priority is modulated by deployment footprint: Checkmate is a niche self-hosted tool, and instances behind private networks or VPNs are significantly less exposed. Deployments with the registration endpoint publicly accessible and no upstream rate-limiting or body-size controls are the highest-priority remediation targets. The attack is automatable, consistent with the AC:L/PR:N vector, meaning a single attacker with modest bandwidth can trigger the condition.

An unauthenticated attacker scripts a pool of concurrent HTTP POST requests to the Checkmate /api/v1/auth/register endpoint, each carrying a multipart body with a large profileImage payload (e.g., several hundred megabytes per request). Because Multer buffers the entire upload in heap memory before the registration handler validates credentials or invite tokens, all concurrent uploads are held in RAM simultaneously; once heap memory is exhausted, the Node.js process crashes or becomes unresponsive and the monitoring platform goes offline. No authentication, session token, or prior knowledge of the application is required.