@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-26019 · CVE overview and exploitation status

EUVD-2026-6211

GHSA-gf3v-fwqg-4vh7

cve-program · CVE-2026-26019

• https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7
• https://github.com/langchain-ai/langchainjs/pull/9990
• https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d
• https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14

euvd · EUVD-2026-6211

• https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7
• https://github.com/langchain-ai/langchainjs/pull/9990
• https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d
• https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14

nvd · CVE-2026-26019

• https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d
• https://github.com/langchain-ai/langchainjs/pull/9990
• https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14
• https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7

osv · GHSA-gf3v-fwqg-4vh7

• https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7
• https://nvd.nist.gov/vuln/detail/CVE-2026-26019
• https://github.com/langchain-ai/langchainjs/pull/9990
• https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d
• https://github.com/langchain-ai/langchainjs
• https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14

No related changes are available here.