@langchain/core vulnerabilities

Latest @langchain/core CVEs

Newest publication first

1. CVE-2025-68665 LangChain serialization injection vulnerability enables secret extraction

   Published 2025-12-23

   Critical·CVSS 9.1 EPSS 0.79%

   LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subsequently when string-ify...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.