EUVD-2026-64037Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Public network endpoint, no credentials or interaction needed, impact is memory exhaustion affecting only availability with no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart profileImage uploads through in-memory Multer parsing before registration validation, without file-size, file-count, or MIME-type limits in server/src/api/middleware/upload.ts. An unauthenticated attacker can submit concurrent oversized files that are buffered before invalid registration or invite-token checks reject the request, exhausting memory and crashing or destabilizing the backend. This issue is fixed in version 3.9.1.
AnalysisAI
Remote memory exhaustion in Bluewave Labs Checkmate prior to version 3.9.1 allows unauthenticated network attackers to crash or destabilize the Node.js backend by submitting concurrent oversized multipart uploads to the public POST /api/v1/auth/register endpoint. The in-memory Multer parser buffers uploaded files before registration validation executes, meaning no file-size, file-count, or MIME-type boundary is enforced prior to business-logic rejection - allowing attacker-controlled allocations to exhaust server RAM. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication or prior account is required - POST /api/v1/auth/register is a fully public endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 High with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Checkmate v3.9.1, available at https://github.com/bluewave-labs/Checkmate/releases/tag/v3.9.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Checkmate deployments and implement strict request size limits (recommend maximum 5-10MB) and connection-level rate limiting on the /api/v1/auth/register POST endpoint to block multipart upload abuse. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Checkmate versions prior to 3.4.0 allow unauthenticated attackers to retrieve unpublished status pages and internal moni
A mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate th
Credential leakage in Bluewave Labs Checkmate versions 3.3.0 through 3.9.1 exposes HTTP Authorization secrets to unauthe
Missing role-guard middleware on three API route groups in Checkmate through v3.11.0 allows any authenticated low-privil
User enumeration via observable response discrepancy in Checkmate through version 2.1.0 exposes whether any given email
ReDoS (catastrophic regex backtracking) in Checkmate monitoring platform versions 3.5.1 through 3.9.1 allows an authenti
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today