Please use LangChain VDP and LangChain Open Source VDP to report security vulnerabilities.
Repository navigation
Security: langchain-ai/langgraphjs
Security
SECURITY.md
-
Store namespaces are not isolated in the LangGraph.js Postgres and Redis storesGHSA-8p8h-xj5r-m5wf published
Oct 8, 2026 by hntrlHigh -
MongoDBStore vector search may return results from unintended namespacesGHSA-hxqq-jqhx-58fp published
Oct 8, 2026 by vladislav-nechakhinLow -
LangGraph.js graph input could be interpreted as a control directiveGHSA-wp87-994x-j95x published
Oct 8, 2026 by eliornlHigh -
SDK defaultHeaders mutation can leak API keys across Client instancesGHSA-432w-3h3v-2pv4 published
Oct 7, 2026 by eliornlLow -
Insecure deserialization in JsonPlusSerializer can lead to arbitrary code executionGHSA-j87f-x5h5-gr75 published
Aug 21, 2026 by hntrlHigh -
Unencoded identifiers can redirect LangGraph SDK requests to unintended API endpointsGHSA-r3xm-q2gp-xjjg published
Oct 7, 2026 by vladislav-nechakhinModerate -
NoSQL parameter injection in MongoDBSaver allows cross-tenant state accessGHSA-98xf-r82g-9mhx published
May 21, 2026 by hntrlModerate -
RediSearch Query Injection in @langchain/langgraph-checkpoint-redisGHSA-5mx2-w598-339m published
Feb 17, 2026 by hntrlModerate
Learn more about advisories related to langchain-ai/langgraphjs in the GitHub Advisory Database