GitHub Repo
LangGraph JS discloses credential isolation flaw: shared header objects may cause API keys to be mixed across clients
LangGraph maintainers published a security advisory on October 7, reporting that the JS SDK modifies caller-provided header objects, which may cause clients to share credentials. The advisory lists patched versions, but the issue requires a specific shared-object configuration to trigger and is rated low risk.