{"data":{"id":"058dcd7f-2c10-4687-8b18-474b656f32e1","title":"CVE-2026-31949: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service (DoS) vulnerability…","summary":"CVE-2026-31949 affects LibreChat versions prior to 0.8.3-rc1. An authenticated attacker can crash the Node.js server process by sending malformed requests to the DELETE /api/convos endpoint, because the route handler destructures req.body.arg without checking that it exists. The resulting unhandled TypeError bypasses Express error handling middleware and triggers process.exit(1).","solution":"This vulnerability is fixed in 0.8.3-rc1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-31949","publishedAt":"2026-03-13T19:54:39.753Z","cveId":"CVE-2026-31949","cweIds":["CWE-248"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["LibreChat"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LibreChat denial of service via DELETE /api/convos endpoint","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.004,"epssCheckedAt":"2026-11-04T18:09:13.251Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T18:11:01.063Z","patchAvailable":null,"disclosureDate":"2026-03-13T19:54:39.753Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}