CVE-2026-54037: LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2025-7105 added forkIpLimiter and forkUserLimiter rate limiters to POST /api/convos/fork to prevent rapid-fire conversation duplication. However, the POST /api/convos/duplicate endpoint — which is in the same file and performs the exact same expensive database operations — was not given any rate limiter. An authenticated user can bypass the CVE-2025-7105 fix by using /duplicate instead of /fork to exhaust server resources. This vulnerability is fixed in 0.8.4-rc1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LibreChatto a version that resolves this vulnerability.Fixed in 0.8.4-rc1 - Configuration
Apply rate limiters to POST /api/convos/duplicate (same file/operations as /api/convos/fork) using the forkIpLimiter and forkUserLimiter approach so /duplicate cannot exhaust server resources by bypassing the CVE-2025-7105 fix.
LibreChat POST /api/convos/duplicate rate limiter = Add rate limiting equivalent to forkIpLimiter and forkUserLimiter (based on /api/convos/fork)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54037?
The severity of CVE-2026-54037 is rated as medium with a score of 6.5.
What are the risks associated with CVE-2026-54037?
CVE-2026-54037 poses a risk of denial of service due to the lack of rate limiting on the POST /api/convos/duplicate endpoint.
How do I fix CVE-2026-54037?
To fix CVE-2026-54037, implement rate limiting on the POST /api/convos/duplicate endpoint to mitigate rapid requests.
What software is affected by CVE-2026-54037?
CVE-2026-54037 affects the LibreChat software prior to version 0.8.4-rc1.
What is the relationship between CVE-2026-54037 and CVE-2025-7105?
CVE-2026-54037 is related to CVE-2025-7105 as it is a follow-up vulnerability resulting from an incomplete fix for the earlier issue.