npm/@langchain/mongodb CVE-2026-106119: medium 6, EPSS 0.46%
LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
Action: Upgrade @langchain/mongodb to 1.3.1 or later.
npm i @langchain/mongodb@1.3.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.3.1 | - |
Fixed versions
| 1.3.1 |
Sources
- osv: GHSA-m6rx-h84q-8r95
- nvd: CVE-2026-106119
- https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95
- https://github.com/langchain-ai/langchainjs/pull/11672
- https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af
- https://github.com/langchain-ai/langchainjs
- https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1
CVE-2026-106119 · published · modified · JSON