CVE-2026-31949: LibreChat denial of service via DELETE /api/convos endpoint

Summary

CVE-2026-31949 affects LibreChat versions prior to 0.8.3-rc1. An authenticated attacker can crash the Node.js server process by sending malformed requests to the DELETE /api/convos endpoint, because the route handler destructures req.body.arg without checking that it exists. The resulting unhandled TypeError bypasses Express error handling middleware and triggers process.exit(1).

Mitigation

This vulnerability is fixed in 0.8.3-rc1.

Related items

• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
• InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-118761: Kubeflow Pipelines decompression bomb in pipeline archive uploadSimilar attack · NVD/CVE Database
• LowOpenCode User Hit with Hostile Backlash After Reporting Free AI LoopholeSimilar attack · Socket Blog