PT-2026-25367 · Librechat · Librechat

Danny-Avila · Published 2026-03-13 · Updated 2026-03-13 · CVE-2026-31949

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.3-rc1

Description A denial of service issue exists in the DELETE /api/convos endpoint of LibreChat. An authenticated attacker can cause the Node.js server process to crash by submitting specially crafted requests. The issue occurs because the server attempts to destructure req.body.arg without first verifying its existence, leading to an unhandled TypeError that terminates the process. The DELETE /api/convos route handler is affected. The req.body.arg variable is vulnerable.

Recommendations Update to version 0.8.3-rc1 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-248

Related Identifiers

BDU:2026-07912

CVE-2026-31949

GHSA-5M32-CHQ6-232P

Affected Products

Librechat

References · 6

• 🔥 https://github.com/danny-avila/LibreChat/security/advisories/GHSA-5m32-chq6-232p · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31949.json · Exploit
• https://bdu.fstec.ru/vul/2026-07912 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31949 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31949 · Security Note
• https://twitter.com/CVEnew/status/2032605881297149970 · Twitter Post