What’s Vulnerable › Vulnerabilities
CVE-2026-31949: LibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convos
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-03-13 · updated 2026-06-17
- Weakness: CWE-248
Description
LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service (DoS) vulnerability exists in the DELETE /api/convos endpoint that allows an authenticated attacker to crash the Node.js server process by sending malformed requests. The DELETE /api/convos route handler attempts to destructure req.body.arg without validating that it exists. The server crashes due to an unhandled TypeError that bypasses Express error handling middleware and triggers process.exit(1). This vulnerability is fixed in 0.8.3-rc1.
Affected products
- danny-avila LibreChat: before 0.8.3 — fixed in 0.8.3
How to fix
Upgrade to a fixed version: danny-avila LibreChat 0.8.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-31949 or the next vulnerability affects your stack