CVE-2026-54024

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.4-rc1

Description An authenticated user can upload arbitrarily large files to exhaust server disk space and memory. This occurs because the 'POST /api/convos/import' endpoint utilizes a separate multer instance that lacks the file size limits implemented in other upload routes. Additionally, the application-level size check is disabled by default as the CONVERSATION IMPORT MAX FILE SIZE BYTES environment variable is commented out in the default configuration.

Recommendations Update to version 0.8.4-rc1. As a temporary mitigation, configure the CONVERSATION IMPORT MAX FILE SIZE BYTES environment variable to restrict the maximum allowed file size for conversation imports.