The vulnerability exists in LibreChat versions prior to 0.8.3-rc1 on the DELETE /api/convos endpoint. The route handler attempts to destructure req.body.arg without validating its presence, resulting in an unhandled TypeError. This throws an exception that bypasses Express error handling middleware and triggers process.exit(1), causing the Node.js server process to crash. The effect is an application crash that renders the chat service unavailable to all users until the server is restarted or upgraded. The weakness is identified as CWE-248 (Unchecked Return Value).

The affected product is LibreChat, authored by danny-avila, on all releases before 0.8.3-rc1. Versions beyond 0.8.3-rc1 contain the fix and are not affected.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying no known active exploitation. Based on the description, the likely attack vector is a remote or network‐based attack performed by an authenticated user who can send DELETE requests to the endpoint. An attacker can force the server to crash, temporarily denying availability for legitimate users.