CVE-2026-55241

Name of the Vulnerable Software and Affected Versions Checkmate versions prior to 3.9.1

Description An unauthenticated attacker can cause a denial of service by submitting concurrent oversized files to the 'POST /api/v1/auth/register' endpoint. The application uses in-memory Multer parsing for the profileImage variable before performing registration or invite-token validation. Because there are no limits on file size, file count, or MIME-type, these files are buffered in memory, which can exhaust system resources and crash or destabilize the backend.

Recommendations Update to version 3.9.1.