CVE-2026-66749

Name of the Vulnerable Software and Affected Versions Let's Chat versions 0.4.0 through 0.4.8

Description An issue exists where authenticated attackers can cause a server crash by providing a valid 24-character hex string for the room parameter that does not correspond to any document in the database. This leads to a null dereference, resulting in an uncaught TypeError within an asynchronous Mongoose callback that terminates the Node.js server process. This flaw is accessible via the 'GET /messages' endpoint and other code paths, including the socket.io interface.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.