The flaw resides in the isPrivateIP function, which fails to recognize IPv4‑mapped IPv6 addresses written in their hex‑normalized form. An authenticated user can craft a request that disguises a private IPv4 address as an IPv6 literal, thereby bypassing the server‑side request forgery (SSRF) filter. The server will then resolve the address and send an HTTP request to target internal network resources, including cloud metadata services, loopback interfaces, and RFC1918 ranges. This allows an attacker to read internal data, obtain sensitive configuration or authentication credentials, and potentially pivot to other internal services.

LibreChat, managed by danny‑avila, is affected in all releases prior to version 0.8.3, including the 0.8.3‑rc1 and 0.8.3‑rc2 builds. The issue is resolved in 0.8.3 and later versions.

The vulnerability has a CVSS score of 8.5, indicating high severity. EPSS is reported below 1%, suggesting low current exploit activity, but the flaw is not listed in the CISA KEV catalog. Attackers must be authenticated to the service; through the protected API, they can send a crafted request that makes the server reach internal IP addresses. The successful exploitation could expose confidential data and enable lateral movement within the internal network.