CVE-2026-66749
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Let's Chat versions 0.4.0 through 0.4.8 contain a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database.
Risk Assessment
An attacker can cause a Node.js server crash (DoS) by sending a crafted request, leading to service disruption and potential loss of availability.
Recommendation
Update Let's Chat to version 0.4.9 or later that fixes this vulnerability, or apply a workaround by validating the room parameter before use.
Other vulnerabilities in Let's Chat
See all- CVE-2026-66751Medium
Let's Chat versions 0.3.0 through 0.4.8 contain an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification.
- CVE-2026-66750Medium
Let's Chat versions 0.3.0 through 0.4.8 contain a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route.
Original NVD description (English source)
Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS