Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, `isPrivateIP()` in `packages/api/src/auth/domain.ts` fails to detect IPv4-mapped IPv6 addresses in their hex-normalized form, allowing any authenticated user to bypass SSRF protection and make the server issue HTTP requests to internal network resources — including cloud metadata services (e.g., AWS `169.254.169.254`), loopback, and RFC1918 ranges. Version 0.8.3 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-27 | 3 | Disclosure1General1Patch1 |
| 2026-03-28 | 1 | Disclosure1 |
CVE-2026-31943 LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, `isPrivateIP()` in `packages/api/src/auth/domain.ts` fails to detect IPv4-mapped IPv6 a… https://www.cve.org/CVERecord?id=CVE-2026-31943
Post summary
CVE-2026-31943 is a newly disclosed vulnerability in LibreChat’s IP detection logic; no PoC, exploit, or patch has been shared.
🟠 CVE-2026-31943 - High LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, `isPrivateIP()` in `packages/api/src/auth/domain.ts` fails to detect IPv4-mapped IPv6 addresses in their hex-nor... https://www.thehackerwire.com/vulnerability/CVE-2026-31943/ https://t.co/MKlmjDGTn7
Post summary
The tweet announces CVE-2026-31943 in LibreChat, describing a flaw in IPv4‑mapped IPv6 detection, but provides no PoC, exploit details, or patch notice.
🟠 CVE-2026-31943 - High LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, `isPrivateIP()` in `packages/api/src/auth/domain.ts` fails to detect IPv4-mapped IPv6 addresses in their hex-nor... https://www.thehackerwire.com/vulnerability/CVE-2026-31943/ https://t.co/ompy8AplAO
Post summary
The message announces CVE‑2026‑31943 in LibreChat as a flaw in IPv4‑mapped IPv6 detection, but does not provide PoC, exploit code, or patch information.
[CVE-2026-31943: HIGH] LibreChat had a cyber security vulnerability in `isPrivateIP()` prior to version 0.8.3, allowing authenticated users to bypass SSRF protection. Upgrade to v0.8.3 to fix it.#cve,CVE-2026-31943,#cybersecurity https://cvefind.com/CVE-2026-31943
Post summary
LibreChat’s isPrivateIP() flaw permits authenticated users to bypass SSRF protection; updating to v0.8.3 resolves the issue.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | librechat | librechat | - | - | - |
| App | librechat | librechat | 0.8.3 | - | - |
| App | librechat | librechat | 0.8.3 | - | - |