LangGraph JS discloses credential isolation flaw: shared header objects may cause API keys to be mixed across clients

LangGraph JS maintainers published security advisory GHSA-432w-3h3v-2pv4 on October 7: if an application passes the same defaultHeaders object to multiple SDK clients, a client created later may overwrite the API key used by an earlier client. The advisory rates the risk Low, assigns a CVSS 4.0 score of 2.1, and lists patched versions. Security advisory

The flaw stems from how JavaScript object references are handled. The BaseClient constructor in the published package directly stores config.defaultHeaders, then writes the key to its x-api-key property. As a result, two clients can point to the same mutable header object even when each has its own apiKey; initializing the second client then changes the credentials the first client sends on subsequent requests. This logic can be verified in the source map for the published 1.5.2 package. Package code

Another detail that can be easy to misread is apiKey: null. The package code shows that this setting skips environment variable loading, but the constructor does not thereby clear a key already present in a shared header object. The code suggests that disabling automatic loading does not guarantee that the final request will omit credentials; you must also check whether another client has modified the header object. Package code

For agent-service integrations, headers and credentials are part of the actual deployment interface. LangChain’s Fleet documentation shows configuring apiUrl, apiKey, and defaultHeaders together with Client, then calling the agent through runs.wait. Engineering teams that extract this kind of configuration into a shared template should check specifically for reused object references. This is a recommended check based on the interface and the flaw’s mechanism; it does not mean the documentation example itself is vulnerable. Official integration documentation

The advisory recommends upgrading the SDK to version 1.12.3 or later and @langchain/langgraph to version 1.4.21 or later; the fix copies the headers during initialization. Deployment validation should confirm that the shared input object is not modified and that different clients continue to send their own keys. The maintainers also state explicitly that an external attacker cannot trigger the issue without the configuration described above, and that LangGraph Platform is not affected. Fix and scope