CVE-2026-66749
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Let's Chat versions 0.4.0 through 0.4.8 contain a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database.
Risk Assessment
An attacker can cause a Node.js server crash (DoS) by sending a crafted request, leading to service disruption and potential loss of availability.
Recommendation
Update Let's Chat to version 0.4.9 or later that fixes this vulnerability, or apply a workaround by validating the room parameter before use.
Other vulnerabilities in Let's Chat
See all- CVE-2026-66751Medium
Let's Chat versions 0.3.0 through 0.4.8 contain an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification.
- CVE-2026-66750Medium
Let's Chat versions 0.3.0 through 0.4.8 contain a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route.
Original NVD description (English source)
Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.