Vulnerability · Published Mar 13, 2026 · Assigned by GitHub_M

CVE-2026-31949LibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convos

Medium 6.5

In plain English

A medium-severity security flaw in LibreChat from danny-avila. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 65.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service (DoS) vulnerability exists in the DELETE /api/convos endpoint that allows an authenticated attacker to crash the Node.js server process by sending malformed requests. The DELETE /api/convos route handler attempts to destructure req.body.arg without validating that it exists. The server crashes due to an unhandled TypeError that bypasses Express error handling middleware and triggers process.exit(1). This vulnerability is fixed in 0.8.3-rc1.

Affected products (as reported)

Vendor	Product	Versions
danny-avila	LibreChat	< 0.8.3-rc1

Weakness: CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/danny-avila/LibreChat/security/advisories/GHSA-5m32-chq6-232p x_refsource_CONFIRM