CVE-2026-66749

MEDIUM

Let's Chat 0.4.0-0.4.8 - Authenticated Room Lookup Denial of Service

Title source: manual
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-66749. PoCs published by theopaid.

AI-analyzed exploit summary Detailed technical analysis of CVE-2026-66749, a NULL pointer dereference in Let's Chat's room lookup logic leading to an uncaught exception and server crash via a crafted HTTP request. The writeup includes root cause analysis, patch diffs, and reproduction steps.

Description

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.

Exploits (1)

github WRITEUP
by theopaid · poc
https://github.com/theopaid/CVE-2026-66749-Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat-

Detailed technical analysis of CVE-2026-66749, a NULL pointer dereference in Let's Chat's room lookup logic leading to an uncaught exception and server crash via a crafted HTTP request. The writeup includes root cause analysis, patch diffs, and reproduction steps.

Classification
Writeup 100%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Let's Chat versions 0.4.0 through 0.4.8
Auth required
Prerequisites: Valid user account (self-registration enabled by default) · Network access to the HTTP port
mistral-large-3 · analyzed Jul 29, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 6.5
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-476
Status published
Products (2)
sdelements/lets-chat 0.4.0 - 0.4.8
sdelements/lets-chat 84981a6d2534445c00ea4e095c934e46943c0b1d - 617207ff3c0c0bf8e3c7a915bd9ec03f1dd8390c
Published Jul 28, 2026
Tracked Since Jul 28, 2026