{"action":"Upgrade @langchain/community to 1.1.14 or later.","affected":[{"fixed":"1.1.14","introduced":"0"}],"component":"@langchain/community","cve_ids":["CVE-2026-26019"],"ecosystem":"npm","epss":0.004,"exploited":false,"fixed_versions":["1.1.14"],"ghsa_id":"GHSA-gf3v-fwqg-4vh7","id":"tcs_01M5KFREYJXC21MCRFVNH2M90B","modified_at":"2026-09-10T03:50:35.047547727Z","published_at":"2026-02-11T15:13:20Z","references":["https://osv.dev/vulnerability/GHSA-gf3v-fwqg-4vh7","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7","https://nvd.nist.gov/vuln/detail/CVE-2026-26019","https://github.com/langchain-ai/langchainjs/pull/9990","https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d","https://github.com/langchain-ai/langchainjs","https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14"],"severity":{"label":"medium","score":4.1},"sources":[{"source":"osv","source_id":"GHSA-gf3v-fwqg-4vh7","url":"https://osv.dev/vulnerability/GHSA-gf3v-fwqg-4vh7"}],"summary":"@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation"}