LangGraph.js MongoDB checkpointer: NoSQL injection in thread ids leaks checkpoints across tenants

CVSS 6.7CVE-2026-48121AI/ML frameworks & servingcurated

Impact

thread_id, checkpoint_ns and checkpoint_id taken from config.configurable are passed straight into a MongoDB find() with no type enforcement. A caller who supplies an object such as {"$ne": null} instead of a string turns the identifier into a query operator, so the lookup escapes its thread scope and returns other threads' checkpoints, including pending writes. On a fleet running multi-tenant agent workloads that means one tenant reading another's conversation state and intermediate tool output. Only applications that forward untrusted input into config.configurable without coercing it to a string are exposed; deployments that use server-issued string ids validated against a schema are not.

Who can reach it

Any user of the agent application whose input reaches config.configurable - typically an unauthenticated or low-privilege API caller of the agent front end. No access to MongoDB itself is needed.

What to do

Upgrade @langchain/langgraph-checkpoint-mongodb to 1.3.1 and redeploy the agent service. As a defence that does not depend on the library, coerce or schema-validate thread_id, checkpoint_ns and checkpoint_id to strings before they reach the checkpointer, and reject non-string values. Versions 1.3.0 and below are affected.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-48121 https://github.com/langchain-ai/langgraphjs/security/advisories/GHSA-98xf-r82g-9mhx https://github.com/langchain-ai/langgraphjs/commit/284226c7ca164b3c81fe2d9e32b10f1fc6b99a3c https://github.com/langchain-ai/langgraphjs/issues/2351

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.