CVE-2026-66749

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66749
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66749.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66749
Published
2026-07-28T15:30:46Z
Modified
2026-10-08T02:51:35Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup
Details

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-476"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66749.json"
}
References

Affected packages

Git / github.com/sdelements/lets-chat

Affected ranges

Type
GIT
Repo
https://github.com/sdelements/lets-chat
Events
Introduced
84981a6d2534445c00ea4e095c934e46943c0b1d
Last Affected
617207ff3c0c0bf8e3c7a915bd9ec03f1dd8390c
Introduced
ebdd712cec56da494e04f3505d10026e6f25051a
Last Affected
a5e8b2d5977fedc167e1efb03a4f80121da4842e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.4.0"
        },
        {
            "last_affected":  "0.4.8"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66749.json"