---
id: "CVE-2026-106119"
page: "https://infrastack.ai/live/CVE-2026-106119"
kind: "vulnerability"
aliases: ["CVE-2026-106119", "GHSA-m6rx-h84q-8r95"]
title: "LangChain: MongoDBChatMessageHistory query injection can allow cross-session access"
severity: "medium"
cvss: 6.0
epss: 0.00463
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "@langchain/mongodb", "fixed": ["1.3.1"], "affected": "<= 1.3.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-agents", "ai-tooling", "cwe-943", "langchain", "mongodb", "node"]
not_affected_if: ["managed-hosting", "server-derived-session-id", "single-user-collection"]
published_at: "2026-10-05T13:53:00+00:00"
first_seen_at: "2026-11-09T22:53:22+00:00"
updated_at: "2026-11-09T23:01:01+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95", "first_seen_at": "2026-11-09T22:53:22+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-m6rx-h84q-8r95", "first_seen_at": "2026-11-09T22:57:50+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106119", "first_seen_at": "2026-11-09T23:10:12+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00463, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-106119"}]
---

# LangChain: MongoDBChatMessageHistory query injection can allow cross-session access

Link for people: https://infrastack.ai/live/CVE-2026-106119 (this .md is for agents)

The MongoDB chat history class in the LangChain JavaScript package does not check that session identifiers are strings, so a structured session ID can be treated as a MongoDB query condition. An attacker who can trigger chat-history operations can read, change, or delete another user's stored conversation when users share one collection.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@langchain/mongodb affected <= 1.3.0 fixed 1.3.1

## How to check

- Check the installed version of `@langchain/mongodb` in your lockfile or with `npm ls @langchain/mongodb`; versions `<= 1.3.0` are affected.
- Search your code for `MongoDBChatMessageHistory` and confirm whether the `sessionId` value can come directly from an untrusted request field.
- Check whether several users' histories share one MongoDB collection.

## Fix

- `@langchain/mongodb` upgrade to `1.3.1` or later.
- Until upgraded, reject session identifiers that are not non-empty strings, and derive them from an authenticated, server-controlled value.

## Timeline

- 2026-11-09T22:53:22+00:00 ghsa-repo https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95
- 2026-11-09T22:57:50+00:00 ghsa https://github.com/advisories/GHSA-m6rx-h84q-8r95
- 2026-11-09T23:10:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106119

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-m6rx-h84q-8r95
- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/langchain-ai/langchainjs/security-advisories/GHSA-m6rx-h84q-8r95
- [fix] Patch: github.com https://github.com/langchain-ai/langchainjs/pull/11672
- [fix] Patch: github.com https://github.com/langchain-ai/langchainjs/commit/946e3d856ff1f8ce7f7b9374c83f680a6ada79af
- [fix] Release: github.com https://github.com/langchain-ai/langchainjs/releases/tag/@langchain/mongodb@1.3.1

## From the sources

## Impact

`MongoDBChatMessageHistory` did not enforce the documented string type for session identifiers at runtime. In affected applications, a structured session identifier could be interpreted as a MongoDB query condition rather than as a literal identifier.

Applications are affected when they pass untrusted session identifier input to `MongoDBChatMessageHistory` and store multiple users’ histories in the same collection. An attacker who can invoke chat-history operations may be able to read, modify, or delete another user’s stored conversation.

Applications that derive the session identifier from an authenticated, server-controlled value and enforce its type are not affected by this path.

## Patches

The issue is fixed in `@langchain/mongodb` version **1.3.1**.

Users of affected versions should upgrade to version 1.3.1 or later. The patched version validates session identifiers at runtime and ensures they are compared as literal values in MongoDB queries.

## Workarounds

If an immediate upgrade is not possible, applications must reject session identifiers that are not non-empty strings. Session identifiers should be derived from an authenticated, server-controlled value and must not be passed directly from an untrusted request field.

Upgrading remains the recommended remediation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_