Allocation of Resources Without Limits or Throttling in LibreChat - CVE-2026-54024
Published: June 3, 2026
Vulnerability identifier: #VU133259
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54024
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the conversation import multer instance for the POST /api/convos/import endpoint when handling uploaded conversation import files. A remote user can upload an arbitrarily large file to cause a denial of service.
The application-level size check is disabled by default when the related environment variable is unset, and the uploaded file is written to disk before being fully read into memory and parsed.
Affected software
LibreChat
How to mitigate CVE-2026-54024
Install security update from vendor's website.
LibreChat - update to 0.8.4 rc1