LibreChat Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the LibreChat repository by danny-avila, specifically in version git 600d217. The issue arises from an unhandled exception that occurs when certain API endpoints receive malformed input. This uncaught exception can cause the server to crash, leading to a full denial-of-service condition. Although a valid JSON Web Token (JWT) is required to exploit this vulnerability, LibreChat allows open registration, enabling unauthenticated attackers to create an account and perform the attack.

Impact

Exploitation of this vulnerability causes the server to crash, leading to a full denial-of-service condition.

Remediation

Users can upgrade to LibreChat version 0.7.6 to address this vulnerability.