CVE-2026-31949
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Mar 13, 2026
CISA due date
—
The record
LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service (DoS) vulnerability exists in the DELETE /api/convos endpoint that allows an authenticated attacker to crash the Node.js server process by sending malformed requests. The DELETE /api/convos route handler attempts to destructure req.body.arg without validating that it exists. The server crashes due to an unhandled TypeError that bypasses Express error handling middleware and triggers process.exit(1). This vulnerability is fixed in 0.8.3-rc1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-248
- CVE-2026-102599 Socket.IO enables bidirectional and low-latency communication for every platform. CWE-248
- CVE-2026-107382 MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB… CWE-248
- CVE-2026-106122 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and… CWE-248
- CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-248
- CVE-2026-105756 vLLM is an inference and serving engine for large language models. CWE-248
- CVE-2026-103387 A weakness has been identified in garycourt uri-js up to 4.4.1. CWE-248
- CVE-2026-102281 Nest is a framework for building scalable Node.js server-side applications. CWE-248