Vulnerability · Published Jul 28, 2026 · Assigned by VulnCheck

CVE-2026-66749Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup

Medium 6.5

In plain English

A medium-severity null pointer dereference in lets-chat from sdelements. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 62.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.

Affected products (as reported)

Vendor	Product	Versions
sdelements	lets-chat	0.4.0 – through 0.4.884981a6d2534445c00ea4e095c934e46943c0b1d – through 617207ff3c0c0bf8e3c7a915bd9ec03f1dd8390c

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/let-s-chat-denial-of-service-via-null-dereference-in-room-lookup third-party-advisory