PT-2026-25367 · Librechat · Librechat

Danny-Avila · Publicado 2026-03-13 · Atualizado 2026-03-13 · CVE-2026-31949

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.3-rc1

Description A denial of service issue exists in the DELETE /api/convos endpoint of LibreChat. An authenticated attacker can cause the Node.js server process to crash by submitting specially crafted requests. The issue occurs because the server attempts to destructure req.body.arg without first verifying its existence, leading to an unhandled TypeError that terminates the process. The DELETE /api/convos route handler is affected. The req.body.arg variable is vulnerable.

Recommendations Update to version 0.8.3-rc1 or later.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-248

Identificadores relacionados

BDU:2026-07912

CVE-2026-31949

GHSA-5M32-CHQ6-232P

Produtos afetados

Librechat

Referências · 6

• 🔥 https://github.com/danny-avila/LibreChat/security/advisories/GHSA-5m32-chq6-232p · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31949.json · Exploit
• https://bdu.fstec.ru/vul/2026-07912 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-31949 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-31949 · Nota de Segurança
• https://twitter.com/CVEnew/status/2032605881297149970 · Publicação no Twitter