Checkmate, an open-source server monitoring tool, has a vulnerability (CVE-2026-55241) in versions before 3.9.1 where the POST /api/v1/auth/register route uses in-memory Multer parsing for multipart profileImage uploads without enforcing file size, count, or MIME-type limits. This occurs before registration validation or invite-token checks, enabling unauthenticated attackers to submit multiple oversized files concurrently. The server buffers these files in memory, leading to uncontrolled resource consumption (CWE-400) and potential denial of service by crashing or destabilizing the backend. The vulnerability is resolved in version 3.9.1.

An unauthenticated attacker can cause a denial of service by exhausting server memory through concurrent oversized file uploads to the registration endpoint. This results in backend crashes or instability, impacting availability. There is no impact on confidentiality or integrity reported.

Upgrade Checkmate to version 3.9.1 or later, where this vulnerability is fixed by enforcing file size, count, and MIME-type limits before buffering uploads. No other mitigation is required as the fix addresses the root cause.