The vulnerability allows an unauthenticated attacker to submit oversized multipart profileImage files to the public registration endpoint before the request is validated. The lack of file size, count, or MIME‑type restrictions causes in‑memory buffering of these uploads, exhausting server memory. Once memory resources are depleted, the backend process crashes or becomes unstable, resulting in a denial of service for all users. This flaw is classified as a resource‑exhaustion weakness (CWE‑400) and a memory leak (CWE‑770).

Checkmate, an open‑source self‑hosted server monitoring platform is vulnerable when running any build before version 3.9.1. The issue resides within the public POST / api/v1/auth/register route processed by Multer middleware in upload.ts. All installations of Checkmate that expose this endpoint to unauthenticated traffic are at risk.

The flaw carries a CVSS score of 7.5, indicating a high‑severity denial of service. No EPSS data is available, but the public nature of the registration endpoint and the absence of access controls make exploitation straightforward. The vulnerability is not currently listed in the CISA KEV catalog. An attacker can trigger the crash by sending large files through the unauthenticated registration API, causing the backend to exhaust memory before rejecting the request.