Is CVE-2026-66749 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-66749?

CVE-2026-66749 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-66749

Description

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.