CVE-2026-66749

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66749
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66749.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66749
Published
2026-07-28T15:30:46Z
Modified
2026-08-12T03:51:41Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup
Details

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-476"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66749.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "84981a6d2534445c00ea4e095c934e46943c0b1d"
                },
                {
                    "last_affected": "617207ff3c0c0bf8e3c7a915bd9ec03f1dd8390c"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/sdelements/lets-chat

Affected ranges

Type
GIT
Repo
https://github.com/sdelements/lets-chat
Events
Introduced
ebdd712cec56da494e04f3505d10026e6f25051a
Last Affected
a5e8b2d5977fedc167e1efb03a4f80121da4842e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.4.0"
        },
        {
            "last_affected": "0.4.8"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66749.json"