CVE-2025-7105

published 2026-02-02

CVE-2025-7105: A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in `/api/convos/fork` to fork numerous contents rapidly. If…

Priority P4 27 medium 5.7 CVSS 3.0

AV N AC L PR L UI R S U C N I N A H

A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in `/api/convos/fork` to fork numerous contents rapidly. If the forked content includes a Mermaid graph with a large number of nodes, it can lead to a JavaScript heap out of memory error upon service restart, causing a denial of service. This issue affects the latest version of the product.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
danny-avila	librechat	< 0.8.4-rc1	0.8.4-rc1
librechat	librechat	<= 0.8.3	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-400