Server-Side Request Forgery Vulnerability in LangChain Framework
CVE-2026-27795

4.1MEDIUM

Key Information:

Vendor: Langchain-ai
Status: Langchainjs
Vendor: CVE Published:; 25 February 2026

🔔 Create Langchain-ai Vulnerability Alert

What is CVE-2026-27795?

Earlier versions of the LangChain framework, specifically those prior to 1.1.8, are susceptible to a redirect-based Server-Side Request Forgery (SSRF) bypass. The vulnerability exists within the RecursiveUrlLoader, which incorrectly validates the initial URL and permits the underlying fetch operation to follow redirects automatically. This behavior can enable a transition from a whitelisted public URL to an internal service or metadata endpoint without proper revalidation. As a recommended security measure, users are urged to upgrade to version 1.1.18, where all redirect hops are validated and automatic redirects are disabled, ensuring that the locations are confirmed safe before proceeding.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch