CVE-2026-66749
Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup
- State
- Published
- Severity
- 7.1 High
- Published
- Jul 28, 2026
- Updated
- Jul 28, 2026
- Reserved
- Jul 27, 2026
Description
Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-476 NULL Pointer Dereference
Affected Products
| Product | Versions |
|---|---|
lets-chatsdelements |
|
References
- Researcher Disclosuretechnical-descriptionexploit
- https://www.vulncheck.com/advisories/let-s-chat-denial-of-service-via-null-dereference-in-room-lookupthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.