CVE-2026-66749 is a null pointer dereference vulnerability in sdelements Let's Chat versions 0.4.0 through 0.4.8. Authenticated attackers can cause a denial of service by supplying a crafted GET /messages request with a 24-character hex string room parameter that matches no document in the database. This triggers an uncaught TypeError in an asynchronous Mongoose callback, terminating the Node.js server process. The same defect can be triggered through multiple code paths, including the socket.io interface. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity. No official patch or remediation level has been published as of the data provided.

Successful exploitation results in a denial of service condition by crashing the Node.js server process running Let's Chat. This disrupts availability for legitimate users. The attack requires authentication but no user interaction and has low complexity. There is no indication of data disclosure or privilege escalation from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users and monitor for unusual GET /messages requests with crafted room parameters. Consider implementing application-level input validation to reject invalid room parameters that do not correspond to existing database documents. Avoid exposing the socket.io interface to untrusted users if possible.