CVE-2026-70656

Name of the Vulnerable Software and Affected Versions Checkmate versions 3.5.1 through 3.9.1

Description An authenticated admin or superadmin can trigger a Regular Expression Denial of Service (ReDoS) by setting the matchMethod to regex and inserting a malicious expression into the expectedValue field during advanced HTTP monitor matching. The system accepts the expression via server/src/api/validation/monitorValidation.ts, and server/src/service/network/AdvancedMatcher.ts evaluates it synchronously against an attacker-controlled HTTP response body on the Node.js main event loop. Because this process lacks a timeout or worker isolation, it can lead to catastrophic backtracking—a condition where a complex regular expression takes an exponential amount of time to process—which freezes API endpoints, monitor checks, and WebSocket connections for all users.

Recommendations Update to version 3.9.2. As a temporary workaround, avoid using the expectedValue field with the matchMethod set to regex for HTTP monitor matching.