What is CVE-2025-7105?

CVE-2025-7105 is a medium-severity vulnerability in Danny-Avila Danny-Avila/librechat, classified under Uncontrolled Resource Consumption. CVSS score: 5.7/10. Published 2026-02-02.

How severe is CVE-2025-7105?

Medium severity. CVSS v3 base score is 5.7 out of 10.

Resource exhaustion in Danny-Avila Danny-Avila/librechat

CVE-2025-7105

A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in `/api/convos/fork` to fork numerous contents rapidly. If the forked content includes a Mermaid graph with a large number of nodes, it can lead to a JavaScript heap out of memory error upon service restart, causing a denial of service. This issue affects the latest version of the product.

Vulnerability class: DoS (Denial of Service)

EPSS: 0.003 (18.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H.

Affected products

Danny-avila Danny-avila/librechat — versions unspecified

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

Frequently asked questions

What is CVE-2025-7105?: CVE-2025-7105 is a medium-severity vulnerability in Danny-Avila Danny-Avila/librechat, classified under Uncontrolled Resource Consumption. CVSS score: 5.7/10. Published 2026-02-02.
How severe is CVE-2025-7105?: Medium severity. CVSS v3 base score is 5.7 out of 10.