CVE-2025-69222
Critical · 9.1CVSS
9.1
EPSS
4.6%
Published
Jan 7, 2026
CISA due date
—
The record
LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | librechat | 0 | 0.8.1-r5 |
| Chainguard | librechat-compat | 0 | 0.8.1-r5 |
| Chainguard | librechat-dev | 0 | 0.8.1-r5 |
Related vulnerabilities
- CVE-2026-27138 Certificate verification can panic when a certificate in the chain has an empty DNS name… Also affects librechat
- CVE-2026-27137 When verifying a certificate chain which contains a certificate containing multiple email… Also affects librechat
- CVE-2026-29087 @hono/node-server allows running the Hono application on Node.js. Also affects librechat
- CVE-2026-29074 SVGO, short for SVG Optimizer, is a Node.js library and command-line application for… Also affects librechat
- CVE-2026-29045 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- CVE-2026-29085 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- CVE-2026-29086 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- GHSA-xpqw-6gx7-v673 SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) Also affects librechat