CVE-2025-66201
NoneCVSS
—
EPSS
0.3%
Published
Nov 29, 2025
CISA due date
—
The record
LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capability
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | librechat | 0 | 0.8.1-r0 |
| Chainguard | librechat-compat | 0 | 0.8.1-r0 |
| Chainguard | librechat-dev | 0 | 0.8.1-r0 |
Related vulnerabilities
- CVE-2026-27138 Certificate verification can panic when a certificate in the chain has an empty DNS name… Also affects librechat
- CVE-2026-27137 When verifying a certificate chain which contains a certificate containing multiple email… Also affects librechat
- CVE-2026-29087 @hono/node-server allows running the Hono application on Node.js. Also affects librechat
- CVE-2026-29074 SVGO, short for SVG Optimizer, is a Node.js library and command-line application for… Also affects librechat
- CVE-2026-29045 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- CVE-2026-29085 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- CVE-2026-29086 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- GHSA-xpqw-6gx7-v673 SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) Also affects librechat