What is CVE-2026-66749?
This is a null pointer dereference vulnerability in Let's Chat versions 0.4.0 through 0.4.8 that allows authenticated attackers to crash the server. By sending a crafted GET /messages request with a valid hex string room parameter that doesn't match any existing document, an attacker can trigger an unhandled exception. Upgrading to a patched version is recommended.
Azərbaycanca: Bu, Let's Chat tətbiqinin 0.4.0-dan 0.4.8-ə qədər versiyalarında autentifikasiya olunmuş istifadəçilərə serveri çökdürməyə imkan verən null pointer dereference zəifliyidir. Hücumçu, bazada mövcud olmayan bir otağa uyğun gələn düzgün formatda hex string göndərməklə xüsusi GET /messages sorğusu vasitəsilə serverin dayanmasına səbəb ola bilər. Tətbiqi ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-476
FAQ2
Does exploiting CVE-2026-66749 require the attacker to be authenticated?
Yes, exploiting this vulnerability requires the attacker to be an authenticated user in the Let's Chat application.
Which request causes the server crash in CVE-2026-66749?
The server crash is triggered by a crafted GET /messages request with a valid hex string room parameter that does not correspond to any existing document in the database.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.