Let's Chat versions 0.4.0 through 0.4.8 contain a null dereference flaw that allows an authenticated attacker to crash the server. By sending a GET /messages request with a valid 24‑character hexadecimal room identifier that does not match any document in the database, an uncaught TypeError is raised inside an asynchronous Mongoose callback, terminating the Node.js process. The same vulnerability can also be triggered via the socket.io interface. The flaw is a Classic "Null Pointer Dereference" (CWE-476) and results in a total loss of availability for the affected service, but does not provide confidentiality or integrity impact. The CVSS score of 7.1 indicates a high severity denial‐of‐service condition.

The affected product is Let's Chat from sdelements, specifically releases 0.4.0 to 0.4.8. The vulnerability manifests in the Node.js backend and is triggered by malformed room IDs supplied by an authenticated user.

The risk is high due to the CVSS score, but the EPSS score is less than 1 %, indicating very low current exploitation probability. The flaw is not listed in CISA’s KEV catalog and requires authenticated access, limiting its immediate impact to users with account privileges. Nonetheless, an attacker who can authenticate can cause repeated crashes, potentially enabling a large‑scale denial of service if the crash cannot be quickly remedied and the service is not automatically restarted.