CVE-2026-66749 | Let's Chat 0.4.0 through 0.4.8 contains a null dereference v… | CVSS 6.5 MEDIUM

Description

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.

Metadata

CVE ID: CVE-2026-66749
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-27 16:27 UTC
Published: 2026-07-28 15:30 UTC
Last updated: 2026-07-28 16:43 UTC
Primary CWE: CWE-476
NULL Pointer Dereference
Vendor / Product: sdelements / lets-chat
Sources: cve.org · NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
sdelements	lets-chat	—	0.4.0 ≤ 0.4.8, 84981a6d2534445c00ea4e095c934e46943c0b1d ≤ 617207ff3c0c0bf8e3c7a915bd9ec03f1dd8390c

Weakness (CWE)

CWE	Source	Description
CWE-476	cna	NULL Pointer Dereference

CVSS scores (2)

Score	Severity	Version	Source	Vector
7.1	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
6.5	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References (2)