CVE-2026-66749: Let's Chat DoS Vulnerability

CVE-2026-66749 Overview

CVE-2026-66749 is a null pointer dereference vulnerability [CWE-476] in Let's Chat versions 0.4.0 through 0.4.8. Authenticated attackers can crash the Node.js server by submitting a valid 24-character hex string as a room parameter that matches no document in the MongoDB collection. The unchecked lookup triggers an uncaught TypeError inside an asynchronous Mongoose callback, terminating the server process. The same defect is reachable through the GET /messages HTTP endpoint and the socket.io interface, giving attackers multiple paths to induce denial of service against the chat application.

Critical Impact
A single authenticated request with a syntactically valid but non-existent room identifier terminates the Let's Chat Node.js process, disrupting service for all users.

Affected Products

Let's Chat 0.4.0
Let's Chat versions 0.4.1 through 0.4.7
Let's Chat 0.4.8

Discovery Timeline

2026-07-28 - CVE-2026-66749 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66749

Vulnerability Analysis

Let's Chat is an open-source, self-hosted chat application built on Node.js and MongoDB using Mongoose as the object data modeling layer. The vulnerable code path handles room lookups by accepting a client-supplied room identifier and querying the database with Room.findById. When the identifier is a syntactically valid 24-character hexadecimal ObjectId, Mongoose accepts it and returns null if no matching document exists. The application then dereferences properties on the null result inside an asynchronous callback, raising an uncaught TypeError that propagates to the Node.js event loop and crashes the process.

Any authenticated user can trigger the flaw, and no elevated privileges or user interaction are required beyond authentication. Because Node.js runs as a single process, one crash removes availability for every connected client.

Root Cause

The root cause is missing null-checking on the return value of the Mongoose room lookup. The developer assumed that a well-formed ObjectId always maps to an existing document, so no defensive handling was added for the null case. When the callback subsequently accesses a property of the returned object, the JavaScript runtime raises TypeError: Cannot read properties of null, which is not caught by any surrounding try/catch or promise rejection handler.

Attack Vector

The attacker authenticates to the Let's Chat instance and issues a GET /messages request with a room query parameter set to any valid 24-character hex string that does not correspond to an existing room, for example 000000000000000000000000. The same effect is reachable through the socket.io channel by emitting a room-scoped event with a non-existent ObjectId. The Node.js worker aborts on the uncaught exception, and unless a supervisor such as pm2 or systemd restarts it, the service remains offline. Repeated requests defeat automatic restarts.

See the VulnCheck advisory and the public proof-of-concept repository listed under
Technical References for the exact request format and reproduction steps.

Detection Methods for CVE-2026-66749

Indicators of Compromise

Repeated GET /messages?room=<24-hex> requests from a single authenticated session followed by an abrupt Node.js process exit.
Application logs containing TypeError: Cannot read properties of null originating from Mongoose callback frames.
Sudden termination of the Let's Chat process without a graceful shutdown entry, immediately after a socket.io room event referencing an unknown ObjectId.

Detection Strategies

Instrument the reverse proxy or application gateway in front of Let's Chat to log room-parameter values and correlate 24-character hex identifiers against known room IDs.
Alert on Node.js process restarts that occur within seconds of an inbound authenticated request touching /messages or the socket.io endpoint.
Enable Mongoose query logging and search for findById calls that return null immediately preceding a process crash.

Monitoring Recommendations

Track process uptime and restart counts for the Let's Chat service through the host operating system or container orchestrator.
Forward application stderr to a centralized logging pipeline and create detections for uncaught TypeError events referencing room lookup functions.
Rate-limit authenticated /messages requests per user and monitor for anomalous request bursts against non-existent room identifiers.

How to Mitigate CVE-2026-66749

Immediate Actions Required

Restrict network access to the Let's Chat service to trusted users while a fix is applied, since exploitation requires only a valid session.
Deploy a process supervisor such as pm2, forever, or a systemd unit with Restart=always to reduce downtime after crashes.
Add a web application firewall rule that rejects /messages requests whose room parameter does not match a room identifier from the current room catalog.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Consult the VulnCheck Security Advisory and the GitHub PoC Repository for the current remediation status. Operators building from source should add a null check after every Room.findById call and return a 404 or 400 response when the lookup yields no document.

Workarounds

Fork the affected Let's Chat release and add explicit null checks around all Mongoose room lookups in the messages and socket.io handlers.
Wrap asynchronous Mongoose callbacks with try/catch blocks and register a process.on('uncaughtException') handler that logs and recovers instead of terminating.
Place Let's Chat behind an authenticated reverse proxy that validates the room parameter against an allow-list of active room IDs before forwarding the request.

bash

# Example systemd hardening to auto-restart the service after a crash
[Service]
ExecStart=/usr/bin/node /opt/lets-chat/app.js
Restart=always
RestartSec=2
StartLimitBurst=10
StartLimitIntervalSec=60