What’s Vulnerable › Vulnerabilities

CVE-2026-66749: Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-28 · updated 2026-10-24
• Weakness: CWE-476

Description

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.

Affected products

• sdelements lets-chat: from 0.4.0 through 0.4.8

References

• https://github.com/theopaid/Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat-
• https://www.vulncheck.com/advisories/let-s-chat-denial-of-service-via-null-dereference-in-room-lookup

Get alerted when CVE-2026-66749 or the next vulnerability affects your stack