CVE-2026-54024: LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-11171 (commit bb58a2d0) added limits: { fileSize } to createMulterInstance() in the file upload routes. However, the POST /api/convos/import endpoint uses a separate multer instance that was never updated with the same limits configuration. Combined with the application-level size check being disabled by default (the CONVERSATIONIMPORTMAXFILESIZEBYTES env var is commented out in .env.example), an authenticated user can upload arbitrarily large files to exhaust server disk space and memory. This vulnerability is fixed in 0.8.4-rc1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LibreChatto a version that resolves this vulnerability.Fixed in 0.8.4-rc1Patch bb58a2d0 - Configuration
Ensure the CONVERSATION_IMPORT_MAX_FILE_SIZE_BYTES env var is enabled (not commented out) so application-level size checks apply, and confirm the POST /api/convos/import endpoint’s multer instance uses the same { fileSize } limits configuration added in the fix.
LibreChat (.env.example and POST /api/convos/import multer upload route) CONVERSATION_IMPORT_MAX_FILE_SIZE_BYTES = uncomment and set to enforce file size limits on conversation import
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54024?
The severity of CVE-2026-54024 is classified as medium with a score of 6.5.
What is CVE-2026-54024 about?
CVE-2026-54024 pertains to an incomplete fix in LibreChat related to missing file size limits in a multer instance for the conversation import functionality.
How do I fix CVE-2026-54024?
To fix CVE-2026-54024, update LibreChat to version 0.8.4-rc1 or later to ensure proper file size limits are applied.
What software is affected by CVE-2026-54024?
CVE-2026-54024 affects LibreChat prior to version 0.8.4-rc1.
What is the risk associated with CVE-2026-54024?
The risk associated with CVE-2026-54024 includes potential denial of service due to uncontrolled file uploads.