CVE-2026-27795 is a medium-severity (CVSS 4.1) Server-Side Request Forgery (SSRF) vulnerability in @langchain/community. A fix is available for @langchain/community — see the affected versions and patch details below.
LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-27795.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, a proxy for how much of the ecosystem is exposed.
@langchain/communitynpmDescription
Summary
A redirect-based Server-Side Request Forgery (SSRF) bypass exists in RecursiveUrlLoader in @langchain/community. The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permits a transition from a safe public URL to an internal or metadata endpoint without revalidation. This is a bypass of the SSRF protections introduced in 1.1.14 (CVE-2026-26019).
Affected Component
- Package:
@langchain/community - Component:
RecursiveUrlLoader - Configuration:
preventOutside(default:true) is insufficient to prevent this bypass when redirects are followed automatically.
Description
RecursiveUrlLoader is a web crawler that recursively follows links from a starting URL. The existing SSRF mitigation validates the initial URL before fetching, but it does not re-validate when the request follows redirects. Because fetch follows redirects by default, an attacker can supply a public URL that passes validation and then redirects to a private network address, localhost, or cloud metadata endpoint.
This constitutes a “check‑then‑act” gap in the request lifecycle: the safety check occurs before the redirect chain is resolved, and the final destination is never validated.
Impact
If an attacker can influence content on a page being crawled (e.g., user‑generated content, untrusted external pages), they can cause the crawler to:
- Fetch cloud instance metadata (AWS, GCP, Azure), potentially exposing credentials or tokens
- Access internal services on private networks (
10.x,172.16.x,192.168.x) - Connect to localhost services
- Exfiltrate response data through attacker-controlled redirect chains
This is exploitable in any environment where RecursiveUrlLoader runs with access to internal networks or metadata services, which includes most cloud-hosted deployments.
Attack Scenario
- The crawler is pointed at a public URL that passes initial SSRF validation.
- That URL responds with a 3xx redirect to an internal target.
- The fetch follows the redirect automatically without revalidation.
- The crawler accesses the internal or metadata endpoint.
Example redirector:
https://302.r3dir.me/--to/?url=http://169.254.169.254/latest/meta-data/
Root Cause
- SSRF validation (
validateSafeUrl) is only performed on the initial URL. - Redirects are followed automatically by fetch (
redirect: "follow"default), so the request can change destinations without additional validation.
Resolution
Upgrade to @langchain/community >= 1.1.18, which validates every redirect hop by disabling automatic redirects and re-validating Location targets before following them.
- Automatic redirects are disabled (
redirect: "manual"). - Each 3xx
Locationis resolved and validated withvalidateSafeUrl()before the next request. - A maximum redirect limit prevents infinite loops.
Reources
- Original SSRF fix (CVE-2026-26019): enforced origin comparison and added initial URL validation
- https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @langchain/community | all versions | 1.1.18npm install @langchain/community@1.1.18 |
Affected Products
langchain communitylangchainDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @langchain/community, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update @langchain/community to 1.1.18 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-27795 is resolved across your whole dependency graph.
Workarounds
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.
Frequently Asked Questions
Is CVE-2026-27795 in your dependencies?
Find it across npm, including transitive dependencies.