feat(core,community): ssrf hardening by hntrl · Pull Request #9990 · langchain-ai/langchainjs

Hunter Lovell (hntrl) · 2026-02-10T21:56:25Z

Summary

Add new @langchain/core/utils/ssrf module with URL validation utilities to protect against SSRF attacks (private IPs, cloud metadata endpoints, localhost)
Harden RecursiveUrlLoader in @langchain/community by integrating shared SSRF utilities — replaces vulnerable startsWith URL matching with origin-based comparison and adds validateSafeUrl before all fetch operations
Bump @langchain/core peer dependency in @langchain/community to >=1.1.21

New exports

@langchain/core/utils/ssrf:
- validateSafeUrl(url, options?) — async URL validation with DNS resolution (throws on unsafe URLs)
- isSafeUrl(url, options?) — non-throwing boolean wrapper
- isPrivateIp(ip) — checks RFC 1918, loopback, link-local ranges
- isCloudMetadata(hostname, ip?) — detects cloud metadata endpoints (AWS, GCP, Azure)
- isLocalhost(hostname, ip?) — detects localhost variations
- isSameOrigin(url1, url2) — origin-based URL comparison

Port the Python SSRF protection module to TypeScript. Includes: - IP validation against private ranges (RFC 1918, loopback, link-local) - Cloud metadata endpoint detection (AWS, GCP, Azure) - Localhost detection (including 127.x range) - Safe URL validation with DNS resolution - Comprehensive test suite (42 tests) Functions exported: - isPrivateIp: Check if IP is in private ranges - isCloudMetadata: Detect cloud metadata endpoints - isLocalhost: Detect localhost variations - validateSafeUrl: Validate URLs are safe to connect to - isSafeUrl: Non-throwing URL safety check Cloud metadata is always blocked, even with allowPrivate flag. Uses Node.js dns/promises for DNS resolution.

Replace unsafe string-based URL origin checking with semantic URL comparison to prevent SSRF bypasses via crafted subdomains. The preventOutside option now correctly uses URL.origin comparison instead of String.startsWith(), which prevents bypasses like 'https://example.com.attacker.com'. - Use semantic URL parsing for origin comparison in RecursiveUrlLoader.getChildLinks - Add private isSameOrigin() helper method for safe URL origin validation - Add comprehensive unit tests for SSRF vulnerability detection - Fixes SSRF advisory: startsWith() check vulnerable to subdomain-based bypasses Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

- Move src/_security/ssrf_protection.ts to src/utils/ssrf_protection.ts - Move src/_security/tests/ssrf_protection.test.ts to src/utils/tests/ssrf_protection.test.ts - Remove _security/ directory entirely - Add ./utils/ssrf_protection export to package.json - Update tsdown.config.ts to include ssrf_protection in build - Auto-generated import_map.ts update includes ssrf_protection export All 42 tests pass. Lint and build successful. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

- Rename src/utils/ssrf_protection.ts to src/utils/ssrf.ts - Rename test file src/utils/tests/ssrf_protection.test.ts to src/utils/tests/ssrf.test.ts - Update import in test file to reference ../ssrf.js - Update package.json export key from ./utils/ssrf_protection to ./utils/ssrf - Update input path in package.json from ./src/utils/ssrf_protection.ts to ./src/utils/ssrf.ts - Update tsdown.config.ts entry from ./src/utils/ssrf_protection.ts to ./src/utils/ssrf.ts - Update import_map.ts export from utils__ssrf_protection to utils__ssrf All tests pass (42 tests), lint passes, and build completes successfully.

…Loader - Add isSameOrigin export to @langchain/core/utils/ssrf.ts for checking URL origin equality - Add comprehensive tests for isSameOrigin covering same origin, different schemes/hosts/ports, invalid URLs, and subdomains - Update RecursiveUrlLoader to import and use shared isSameOrigin and validateSafeUrl utilities - Remove private isSameOrigin method from RecursiveUrlLoader (now uses shared implementation) - Add SSRF validation before all fetch calls in getUrlAsDoc and getChildUrlsRecursive with allowHttp: true flag - All tests pass, lint passes, builds succeed for both @langchain/core and @langchain/community

…1.1.21 RecursiveUrlLoader now imports from @langchain/core/utils/ssrf, which is available in v1.1.20+. Update the peer dependency lower bound to ensure users cannot install an incompatible version of @langchain/core. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

- feat(core): Add SSRF protection module - fix(community): Harden RecursiveUrlLoader against SSRF attacks

changeset-bot · 2026-02-10T21:56:32Z

🦋 Changeset detected

Latest commit: 812884e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 13 packages

Name	Type
@langchain/core	Minor
@langchain/community	Major
langchain	Major
@langchain/anthropic	Major
@langchain/google-cloud-sql-pg	Patch
@langchain/google-common	Major
@langchain/google-genai	Major
@langchain/google-webauth	Major
@langchain/model-profiles	Patch
@langchain/standard-tests	Patch
@langchain/google-gauth	Major
@langchain/google-vertexai-web	Major
@langchain/google-vertexai	Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

…1.1.21

- Replace dns/promises and net imports with pure JS implementations - Add IPv4/IPv6 validation using regex and string parsing (no Node.js deps) - Remove net.Socket usage from expandIpv6 - Use dynamic import for DNS resolution with graceful fallback for non-Node environments - All 50 SSRF tests pass - Module now works in browsers, Cloudflare Workers, Deno, Vercel Edge, etc. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

… resolution - Removed resolveDns function and its Node.js-only dynamic import - Changed validateSafeUrl from async to sync (Promise<string> -> string) - Changed isSafeUrl from async to sync (Promise<boolean> -> boolean) - Updated all test cases to remove 'await' keywords - Updated RecursiveUrlLoader to remove 'await' before validateSafeUrl call - Functions now perform only static hostname/IP validation without DNS lookups - Still blocks private IPs, cloud metadata endpoints, and localhost as before - Works across all environments (Node.js, browsers, workers) without DNS Tests: 50 passing Build: ✓ @langchain/core ✓ @langchain/community

Christian Bromann (christian-bromann)

Thanks for tackling this important security issue! This is an excellent implementation of SSRF protection that addresses critical vulnerabilities in the RecursiveUrlLoader. The new utilities module is comprehensive and well-tested. LGTM 👍

Christian Bromann (christian-bromann) · 2026-02-11T00:18:05Z

libs/langchain-core/src/utils/ssrf.ts

+
+  const prefixLen = parseInt(prefixStr, 10);
+  if (isNaN(prefixLen)) {
+    return null;


Consider adding validation for the prefixLen parameter to ensure it's non-negative:

Suggested change

return null;

const prefixLen = parseInt(prefixStr, 10);

if (isNaN(prefixLen) || prefixLen < 0) {

return null;

}

Christian Bromann (christian-bromann) · 2026-02-11T00:18:06Z

libs/langchain-community/src/document_loaders/web/recursive_url.ts

  private async getUrlAsDoc(url: string): Promise<Document | null> {
    let res;
    try {
+      validateSafeUrl(url, { allowHttp: true });


The validateSafeUrl call is synchronous but placed before an async operation. Consider awaiting it for consistency with the other call on line 174:

Suggested change

validateSafeUrl(url, { allowHttp: true });

await validateSafeUrl(url, { allowHttp: true });

Christian Bromann (christian-bromann) · 2026-02-11T00:18:06Z

libs/langchain-community/src/document_loaders/tests/recursive_url.test.ts

@@ -0,0 +1,83 @@
+import { test, describe, expect } from "@jest/globals";
+import { RecursiveUrlLoader } from "../web/recursive_url.js";


Consider adding an integration test that actually instantiates the loader and verifies the SSRF protection works end-to-end, rather than just testing the logic in isolation.

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

Hunter Lovell (hntrl) and others added 7 commits February 10, 2026 12:30

chore: add changeset for SSRF protection changes

0c3a1f7

- feat(core): Add SSRF protection module - fix(community): Harden RecursiveUrlLoader against SSRF attacks

github-actions bot added community Issues related to `@langchain/community` pkg:@langchain/community labels Feb 10, 2026

Hunter Lovell (hntrl) and others added 6 commits February 10, 2026 14:00

fix: change @langchain/core peer dependency format from >=1.1.21 to ^…

ae26c72

…1.1.21

cr

8a57d51

cr

64c9606

cr

812884e

Christian Bromann (christian-bromann) approved these changes Feb 11, 2026

View reviewed changes

github-actions bot added the ready label Feb 11, 2026

Hunter Lovell (hntrl) merged commit d5e3db0 into main Feb 11, 2026
38 of 39 checks passed

Hunter Lovell (hntrl) deleted the hunter/ssrf branch February 11, 2026 00:23

github-actions bot mentioned this pull request Feb 11, 2026

chore: version packages #9989

Merged

Mia (miadisabelle) pushed a commit to avadisabelle/ava-langchainjs that referenced this pull request Feb 18, 2026

feat(core,community): ssrf hardening (langchain-ai#9990)

a4fab77

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

Nick Winder (nickwinder) pushed a commit to nickwinder/langchainjs that referenced this pull request Mar 24, 2026

feat(core,community): ssrf hardening (langchain-ai#9990)

9e49046

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(core,community): ssrf hardening#9990

feat(core,community): ssrf hardening#9990
Hunter Lovell (hntrl) merged 13 commits intomainfrom
hunter/ssrf

Hunter Lovell (hntrl) commented Feb 10, 2026 •

edited

Loading

Uh oh!

changeset-bot bot commented Feb 10, 2026 •

edited

Loading

Uh oh!

Christian Bromann (christian-bromann) left a comment

Uh oh!

Christian Bromann (christian-bromann) Feb 11, 2026

Uh oh!

Christian Bromann (christian-bromann) Feb 11, 2026 •

edited

Loading

Uh oh!

Christian Bromann (christian-bromann) Feb 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	validateSafeUrl(url, { allowHttp: true });
	await validateSafeUrl(url, { allowHttp: true });

		@@ -0,0 +1,83 @@
		import { test, describe, expect } from "@jest/globals";
		import { RecursiveUrlLoader } from "../web/recursive_url.js";

Conversation

Hunter Lovell (hntrl) commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

changeset-bot bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Christian Bromann (christian-bromann) left a comment

Choose a reason for hiding this comment

Uh oh!

Christian Bromann (christian-bromann) Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Christian Bromann (christian-bromann) Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Christian Bromann (christian-bromann) Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Hunter Lovell (hntrl) commented Feb 10, 2026 •

edited

Loading

changeset-bot bot commented Feb 10, 2026 •

edited

Loading

Christian Bromann (christian-bromann) Feb 11, 2026 •

edited

Loading