How many CVEs have a located fix in danny-avila/librechat?

26 published CVEs have a fix traced to functions in danny-avila/librechat, touching 97 functions across 133 files.

Which function in danny-avila/librechat has been patched by the most CVEs?

buildEndpointOption in api/server/middleware/buildEndpointOption.js has been changed by 3 CVE fixes, from 2025 to 2025.

How large is a typical CVE fix in danny-avila/librechat?

The median fix changes 78 lines. 19% of fixes change 20 lines or fewer, and 31% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

javascript

typescript

#191 of 500 repositories

danny-avila/librechat

Name: danny-avila/librechat: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix February 2, 2026

26

CVE fixes located

Published CVEs

97

Functions patched

Distinct function sites

133

Files patched

Distinct source files

2024–2026

Years covered

By CVE publication date

Overview

26 published CVEs have a fix traced to functions in danny-avila/librechat, the earliest published in 2024. Those fixes changed 97 distinct functions across 133 files, in 613 patch hunks.

Among the 500 repositories tracked here, danny-avila/librechat ranks #191 by the number of CVEs with a located fix.

Most patched functions

Functions in danny-avila/librechat changed by the most CVE fixes.

Most patched files

Files in danny-avila/librechat changed by the most CVE fixes.

1api/app/clients/BaseClient.js3 CVEs · 3 functions
2api/models/Message.js3 CVEs · 2 functions
3api/server/controllers/AskController.js3 CVEs · 1 functions
4api/server/middleware/buildEndpointOption.js3 CVEs · 1 functions
5api/server/routes/files/files.js3 CVEs · 1 functions
6api/server/routes/prompts.js3 CVEs · 0 functions
7packages/data-schemas/src/models/plugins/mongoMeili.ts2 CVEs · 4 functions
8api/server/services/Files/process.js2 CVEs · 2 functions
9api/server/controllers/EditController.js2 CVEs · 1 functions
10api/server/middleware/validateImageRequest.js2 CVEs · 1 functions

Fix size

How much code a CVE fix in danny-avila/librechat changes, with backports counted once.

78

Median lines changed

Added plus removed, per CVE

19%

Fixes of 20 lines or fewer

Share of CVE fixes

31%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in danny-avila/librechat, and the functions each fix changed.

Denial of Service via JavaScript Memory Overflow in danny-avila/librechat
CVE-2025-7105localize mongoMeili
Medium · CVSS 5.7
EPSS 0.3%2026-02-02
LibreChat MCP Stdio Remote Command Execution
CVE-2026-22252oauth
Critical · CVSS 9.9
EPSS 4.2%2026-01-12
LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions
CVE-2025-69222isActionDomainAllowed SupportedProtocol parseDomainSpec
Critical · CVSS 9.1
EPSS 4.6%2026-01-07
LibreChat has Insufficient Access Control for Agent Permission Queries
CVE-2025-69221
Medium · CVSS 4.3
EPSS 0.3%2026-01-07
LibreChat has Insufficient Access Control for Agent Files
CVE-2025-69220
High · CVSS 7.1
EPSS 0.3%2026-01-07
LibreChat's Improper Input Validation in Prompt Creation API Enables Unauthorized Permission Changes
CVE-2025-66451object handleJsonParseError
Medium · CVSS 5.3
EPSS 0.3%2025-12-11
LibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Upload
CVE-2025-66450buildEndpointOption
High · CVSS 8.6
EPSS 0.2%2025-12-11
Denial of Service in danny-avila/librechat
CVE-2025-8849loadMemoryConfig
High · CVSS 7.5
EPSS 0.3%2025-10-30
Insecure API Design in danny-avila/librechat
CVE-2025-8850TDisable2FARequest Account disableTwoFactor
High · CVSS 8.8
EPSS 0.4%2025-10-30
Mass Assignment in danny-avila/librechat
CVE-2025-7104object
High · CVSS 7.5
EPSS 0.3%2025-09-29
Authorization Bypass due to Incorrect Access Control in danny-avila/librechat
CVE-2025-7106getProviderConfig isKnownCustomProvider
Medium · CVSS 5.3
EPSS 0.3%2025-09-23
Improper Authorization in danny-avila/librechat
CVE-2025-6088ShareServiceError ISharedLink SchemaWithMeiliMethods
Low · CVSS 3.1
EPSS 0.3%2025-09-11

Get an alert for each new danny-avila/librechat CVE, with the patched functions and AI-written analysis.

Monitor librechat CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

baptisteArno/typebot.io26 CVEs firefly-iii/firefly-iii26 CVEs getkirby/kirby26 CVEs LibVNC/libvncserver26 CVEs mdadams/jasper26 CVEs moby/moby26 CVEs muttmua/mutt26 CVEs osTicket/osTicket26 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in danny-avila/librechat.

How many CVEs have a located fix in danny-avila/librechat?: 26 published CVEs have a fix traced to functions in danny-avila/librechat, touching 97 functions across 133 files.
Which function in danny-avila/librechat has been patched by the most CVEs?: buildEndpointOption in api/server/middleware/buildEndpointOption.js has been changed by 3 CVE fixes, from 2025 to 2025.
How large is a typical CVE fix in danny-avila/librechat?: The median fix changes 78 lines. 19% of fixes change 20 lines or fewer, and 31% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track danny-avila/librechat CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing