@LANGCHAIN/MONGODB · CVE-2026-106119 · AI agents & MCP
FIX → 1.3.1
The MongoDB chat history class in the LangChain JavaScript package does not check that session identifiers are strings, so a structured session ID can be treated as a MongoDB query condition. An attacker who can trigger chat-history operations can read, change, or delete another user's stored conversation when users share one collection.
first public Oct 5, 2026 · 3 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that pass untrusted session identifier input into MongoDBChatMessageHistory and store multiple users' histories in the same collection are exposed. Applications that derive the session ID from an authenticated, server-controlled value and enforce its type are not affected by this path.
Not affected if managed-hosting, server-derived-session-id, single-user-collection
Who cares ai-agents, langchain, mongodb, node
@langchain/mongodb in your lockfile or with npm ls @langchain/mongodb; versions <= 1.3.0 are affected.MongoDBChatMessageHistory and confirm whether the sessionId value can come directly from an untrusted request field.MongoDBChatMessageHistory did not enforce the documented string type for session identifiers at runtime. In affected applications, a structured session identifier could be interpreted as a MongoDB query condition rather than as a literal identifier.
Applications are affected when they pass untrusted session identifier input to MongoDBChatMessageHistory and store multiple users’ histories in the same collection. An attacker who can invoke chat-history operations may be able to read, modify, or delete another user’s stored conversation.
Applications that derive the session identifier from an authenticated, server-controlled value and enforce its type are not affected by this path.
The issue is fixed in @langchain/mongodb version 1.3.1.
Users of affected versions should upgrade to version 1.3.1 or later. The patched version validates session identifiers at runtime and ensures they are compared as literal values in MongoDB queries.
If an immediate upgrade is not possible, applications must reject session identifiers that are not non-empty strings. Session identifiers should be derived from an authenticated, server-controlled value and must not be passed directly from an untrusted request field.
Upgrading remains the recommended remediation.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 1.3.1
@langchain/mongodb upgrade to 1.3.1 or later.This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.