CVE-2026-66749
MEDIUMLet's Chat 0.4.0-0.4.8 - Authenticated Room Lookup Denial of Service
Title source: manualExploitation Summary
EIP tracks 1 public exploit for CVE-2026-66749. PoCs published by theopaid.
AI-analyzed exploit summary Detailed technical analysis of CVE-2026-66749, a NULL pointer dereference in Let's Chat's room lookup logic leading to an uncaught exception and server crash via a crafted HTTP request. The writeup includes root cause analysis, patch diffs, and reproduction steps.
Description
Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.
Exploits (1)
Detailed technical analysis of CVE-2026-66749, a NULL pointer dereference in Let's Chat's room lookup logic leading to an uncaught exception and server crash via a crafted HTTP request. The writeup includes root cause analysis, patch diffs, and reproduction steps.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H