Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in `RecursiveUrlLoader` in `@langchain/community`. The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permits a transition from a safe public URL to an internal or metadata endpoint without revalidation. This is a bypass of the SSRF protections introduced in 1.1.14 (CVE-2026-26019). Users should upgrade to `@langchain/community` 1.1.18, which validates every redirect hop by disabling automatic redirects and re-validating `Location` targets before following them. In this version, automatic redirects are disabled (`redirect: "manual"`), each 3xx `Location` is resolved and validated with `validateSafeUrl()` before the next request, and a maximum redirect limit prevents infinite loops.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-25 | 2 | Disclosure2 |
| 2026-02-26 | 1 | Disclosure1 |
| 2026-06-13 | 1 | Patch1 |
@mem0ai Security & dependencies → Upgrade @langchain/community to fix CVE-2026-27795 and CVE-2026-26019 → Resolve all medium Dependabot alerts via pnpm overrides.
Post summary
The message advises upgrading @langchain/community to apply a patch that addresses CVE‑2026‑27795 and CVE‑2026‑26019.
CVE-2026-27795 LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in `Recursiv… https://www.cve.org/CVERecord?id=CVE-2026-27795
Post summary
CVE‑2026‑27795 is a redirect‑based SSRF bypass in LangChain before v1.1.8, with no PoC, exploit, or patch mentioned.
CVE-2026-27795: The Chain Breaker: Bypassing LangChain's SSRF Guards A sophisticated Server-Side Request Forgery (SSRF) bypass was discovered in the `@langchain/community` package, specifically within the `RecursiveUrlLoader`. Despite previous attempt... https://cvereports.com/reports/CVE-2026-27795
Post summary
A new SSRF bypass vulnerability was identified in LangChain's RecursiveUrlLoader, indicating a potential security flaw in the @langchain/community package.
CVE-2026-27795 Server-Side Request Forgery Vulnerability in LangChain RecursiveUrlLoader https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27795
Post summary
A new SSRF vulnerability (CVE-2026-27795) affecting LangChain's RecursiveUrlLoader has been disclosed, with no PoC, exploit, patch, or active exploitation details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | langchain | langchain_community | - | node.js | - |