CVE-2024-11172: Denial of Service in danny-avila/librechat

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-03-20 · updated 2026-06-17
Weakness: CWE-248

Description

A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandled exception will cause the server to crash. This issue is fixed in version 0.7.6.

Affected products

danny-avila LibreChat: before 0.7.6 — fixed in 0.7.6

How to fix

Upgrade to a fixed version: danny-avila LibreChat 0.7.6. Check the vendor advisory for mitigations.

References

https://github.com/danny-avila/librechat/commit/976784c01fa4cce00d4c2941801d56aed375c21b
https://huntr.com/bounties/c76a7ee3-2e26-45a0-8940-21c749592105

Get alerted when CVE-2024-11172 or the next vulnerability affects your stack