An authenticated administrator or superadministrator of the open-source monitoring tool Checkmate can configure advanced HTTP monitor matching to use a regular expression. By inserting a malicious regex into the expectedValue field, the server side matcher executes the expression synchronously on the Node.js main event loop without a timeout or worker isolation. The badly‑crafted regex triggers catastrophic backtracking, which can freeze API endpoints, monitoring checks, and WebSocket connections for all users, effectively denying service. This flaw is known as a Regular Expression Denial of Service (ReDoS) and is identified as CWE‑1333.

The vulnerability affects Checkmate versions 3.5.1 through 3.9.2 released by bluewave‑labs. Any installation of these versions that allows an administrator to set the monitor matchMethod to regex is susceptible. The issue was fixed in the 3.9.2 update, so only systems running earlier releases are impacted.

With a CVSS score of 4.9 the flaw carries moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no widely‑known exploitation at this time. Attackers need authenticated admin or superadmin privileges to deploy the malicious regex; once set, the attacker can initiate a denial of service by triggering the matching logic with a payload that causes deep backtracking. Internal-facing or exposed API endpoints can become unresponsive, disrupting monitoring and potentially cascading to other services that depend on those endpoints. Given these conditions, the risk is contingent upon privileged access but can have significant operational impact if exploited.