CVE-2026-66749
Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.
- Score
- CVSS 4.0 7.1 High
- Status
- Deferred - disclosure@vulncheck.com
- Published
- 2026-07-28
- Last modified
- 2026-10-24
- Weaknesses
- CWE-476
Affected products
References
- https://github.com/theopaid/Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat-
- https://www.vulncheck.com/advisories/let-s-chat-denial-of-service-via-null-dereference-in-room-lookup
