Vulnerability details

CVE-2026-66749

sdelements lets-chat

Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup

CVSS 4.0

7.1High

Official description

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.

CVSS scores

Score	Version	Source	Vector
7.1High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`
6.5Medium	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
sdelements	lets-chat	0.4.0 ≤ v ≤ 0.4.8	CVEProject cvelistV5 (CNA)
sdelements	lets-chat	84981a6d2534445c00ea4e095c934e46943c0b1d ≤ v ≤ 617207ff3c0c0bf8e3c7a915bd9ec03f1dd8390c	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/theopaid/Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat- technical-descriptionexploit
https://www.vulncheck.com/advisories/let-s-chat-denial-of-service-via-null-dereference-in-room-lookup third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-28
Last updated: 2026-07-28
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.43%

Probability of exploitation in 30 days

38%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-476
NULL Pointer Dereference