CVE-2026-54037: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2025-710

LibreChat, a tool that lets users chat with multiple AI providers, had an incomplete security fix. While developers added rate limiters (controls that limit how many requests can be made in a short time) to one endpoint called /fork to stop users from duplicating conversations too quickly, they forgot to add the same protection to a similar endpoint called /duplicate, which does the same resource-heavy database work. An authenticated user (someone with a valid login) could exploit this gap by using /duplicate instead of /fork to overwhelm the server.