LibreChat Server-Side Request Forgery using DNS resolution

The SSRF vulnerability in LibreChat allows an attacker to craft malicious requests that appear to originate from the LibreChat server itself. Because the hostname validation is insufficient, DNS resolution of a hostname to a private IP address bypasses the intended protection. This enables access to internal services that should be inaccessible from the outside world. For example, an attacker could potentially access an internal Retrieval-Augmented Generation (RAG) API, retrieve sensitive data from a cloud instance's metadata endpoint, or even interact with other internal services exposed within the same network. The blast radius extends to any internal resource accessible via HTTP/HTTPS from the LibreChat server.

Organizations deploying LibreChat, particularly those with internal APIs or cloud infrastructure accessible from the same network as the LibreChat server, are at risk. Shared hosting environments where LibreChat is installed alongside other applications are also vulnerable, as a successful SSRF attack could potentially compromise other services on the same host.

• nodejs / server:

  journalctl -u librechat -f | grep -i "server-side request forgery"

• generic web:

  curl -I http://<librechat_server>/agent_actions/some_internal_ip | grep -i "internal_resource"

• generic web:

  grep -r "internal_resource" /var/log/nginx/access.log

1. 2026-03-27Disclosure

   disclosure

1. Réservé2026-03-10
2. Publiée2026-03-27
3. Modifiée2026-03-30
4. EPSS mis à jour2026-04-04

The primary mitigation for CVE-2026-31945 is to upgrade LibreChat to version 0.8.3-rc1 or later, which includes the corrected hostname validation. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to block outbound requests to internal IP addresses or known sensitive endpoints. Additionally, restrict network access to the LibreChat server to only necessary ports and services. Review and harden the configuration of any internal resources that could be targeted by an SSRF attack. After upgrading, confirm the fix by attempting to access an internal resource via LibreChat's agent actions or MCP and verifying that the request is blocked.