CVE-2026-70656mediumCWE-1333

CVE-2026-70656: medium-severity vulnerability in bluewave-labs Checkmate

Checkmate: Regular Expression Denial of Service (ReDoS) via User-Controlled Regex in Monitor Advanced Matching

Published

Follow this CVE+ Monitor Checkmate

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.9epss 0.6%
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.5.1 until 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression in the expectedValue field for advanced HTTP monitor matching. server/src/api/validation/monitorValidation.ts accepts the expression, and server/src/service/network/AdvancedMatcher.ts synchronously evaluates it against an attacker-controlled HTTP response body on the Node.js main event loop without a timeout or worker isolation, allowing catastrophic backtracking to freeze API endpoints, monitor checks, and WebSocket connections for all users. This issue is fixed in version 3.9.2.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected products
bluewave-labs · Checkmate
Related CVEs — bluewave-labs Checkmate

In the same product, most dangerous first.

CVE-2026-55241HIGHCheckmate: Pre-auth Denial of Service via File Upload on RegistrationEPSS 0.6%CVE-2026-85390HIGHCheckmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion RoutesEPSS 0.5%CVE-2026-71862HIGHCheckmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is EnabledEPSS 0.5%CVE-2026-30829MEDIUMCheckmate: Unauthenticated Access to Unpublished Status PageEPSS 0.4%CVE-2026-72588MEDIUMbluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password RecoveryEPSS 0.4%CVE-2026-31836HIGHMass Assignment Privilege Escalation in CheckmateEPSS 0.3%