CVE-2024-11169: Librechat

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handling file uploads. An unauthenticated user can trigger this exception by sending a specially crafted request, causing the server to crash. The vulnerability is fixed in version 0.7.6.

Affected products

• Librechat Librechat: before 0.7.6 (fixed in 0.7.6)

Published 2025-03-20. Last modified 2026-06-17.