LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in "RecursiveUrlLoader" in "@langchain/community". The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permits a transition from a safe public URL to an internal or metadata endpoint without revalidation. This is a bypass of the SSRF protections introduced in 1.1.14 (CVE-2026-26019). Users should upgrade to "@langchain/community" 1.1.18, which validates every redirect hop by disabling automatic redirects and re-validating "Location" targets before following them. In this version, automatic redirects are disabled ("redirect: "manual""), each 3xx "Location" is resolved and validated with "validateSafeUrl()" before the next request, and a maximum redirect limit prevents infinite loops.