CVE-2026-54037

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.4-rc1

Description An authenticated user can exhaust server resources by exploiting a missing rate limiter on the 'POST /api/convos/duplicate' endpoint. While rate limiters were previously implemented for the 'POST /api/convos/fork' endpoint to prevent rapid conversation duplication, the duplicate endpoint performs the same resource-intensive database operations without such protections, allowing a bypass of existing resource limits.

Recommendations Update to version 0.8.4-rc1.