CVE-2026-31943 Details
Description
LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, `isPrivateIP()` in `packages/api/src/auth/domain.ts` fails to detect IPv4-mapped IPv6 addresses in their hex-normalized form, allowing any authenticated user to bypass SSRF protection and make the server issue HTTP requests to internal network resources — including cloud metadata services (e.g., AWS `169.254.169.254`), loopback, and RFC1918 ranges. Version 0.8.3 fixes the issue.
A server-side request forgery (SSRF) vulnerability has been identified in LibreChat versions prior to 0.8.3. The issue arises in the 'isPrivateIP()' function, which fails to properly detect IPv4-mapped IPv6 addresses in their hex-normalized form. This oversight allows authenticated users to bypass SSRF protections and make the server send HTTP requests to internal network resources, including cloud metadata services, loopback addresses, and private IP ranges. The vulnerability is rooted in a normalization mismatch between the SSRF validation process and the Node.js URL parser, which silently converts IPv4-mapped IPv6 addresses to hex notation, evading proper validation. As a result, private addresses are incorrectly treated as public, enabling potential access to sensitive internal resources.
Users are advised to update to LibreChat version 0.8.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/danny-avila/LibreChat/security/advisories/GHSA-w5r7-4f94-vp4c | CISA-ADP | ExploitVendor Advisory |
| https://github.com/danny-avila/LibreChat/security/advisories/GHSA-w5r7-4f94-vp4c | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| librechat librechat | < 0.8.3 0.8.3 rc1 0.8.3 rc2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | CVE Modified | CISA-ADP |
| Mar 30, 2026 | Initial Analysis | [email protected] |
| Mar 27, 2026 | New CVE Received | [email protected] |