LangGraph CVE-2026-118668 (GHSA-4hm6-w6qq-w73v): with JavaScript/TypeScript custom auth, Store namespace rewrites from the authorization handler aren't applied, so one user can read or delete another user's Store data. Which langgraph-api versions are affected?

What it is: LangGraph deployments can use custom authentication with an authorization handler for the long-term memory Store. A common pattern is for the handler to rewrite the requested namespace so each user only touches their own data. In langgraph-api before 0.15.0, when the handler is written in JavaScript or TypeScript, the rewritten namespace was not carried back to the server before the Store operation ran. An ordinary logged-in user could then read, overwrite, search or delete Store data belonging to other users. LangChain published the advisory on October 28, 2026 (rated high). Am I affected (all must apply): - langgraph-api 0.1.2 up to (not including) 0.15.0, including self-hosted LangGraph servers and images built on it. - JavaScript/TypeScript custom auth (Python handlers are not affected). - The Store authorization handler restricts users by rewriting the namespace, rather than rejecting requests outside the user's namespace. - Several users' data lives in the same Store. Fix: 1. Upgrade langgraph-api to 0.15.0 or later (rebuild the server image or redeploy). The fixed server applies the handler's changes and rejects requests whose final namespace isn't authorized. 2. Until then, change the JS/TS Store handler to reject (throw/deny) any request whose namespace doesn't start with the caller's own prefix, instead of silently rewriting it. 3. Review Store contents and access logs for cross-user reads, writes or deletes if untrusted users had accounts on an affected deployment. Verify: confirm the server's langgraph-api version is 0.15.0+, then test as one user that a Store search or get for another user's namespace is denied. Sources: https://github.com/langchain-ai/langgraph/security/advisories/GHSA-4hm6-w6qq-w73v https://github.com/advisories/GHSA-4hm6-w6qq-w73v https://vuldb.com/vuln/428223