CVE-2026-42343

FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insufficient resource isolation and uncontrolled resource consumption. The service relies solely on an application-level soft limit (a 500ms polling interval) for memory management and lacks strict OS-level constraints such as cgroups or kernel-level namespaces. This architectural weakness allows attackers to easily bypass memory checks via time-window attacks, or exhaust the entire JavaScript worker pool via concurrent CPU-intensive requests, resulting in a complete Denial of Service (DoS) for legitimate users. At time of publication, there are no publicly available patches.

CVSS

No CVSS.

References

Link	Resource
https://github.com/labring/FastGPT/security/advisories/GHSA-qv7v-r94x-6x3x
https://github.com/labring/FastGPT/security/advisories/GHSA-qv7v-r94x-6x3x

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-08 23:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-42343

Mitre link : CVE-2026-42343

CVE.ORG link : CVE-2026-42343

JSON object : View

Products Affected

No product.

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-42343", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42343", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T02:10:18.323264Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "labring", "product": "FastGPT", "versions": [{"status": "affected", "version": "<= 4.14.13"}]}]}], "published": "2026-05-08T23:16:37.050", "references": [{"url": "https://github.com/labring/FastGPT/security/advisories/GHSA-qv7v-r94x-6x3x", "source": "security-advisories@github.com"}, {"url": "https://github.com/labring/FastGPT/security/advisories/GHSA-qv7v-r94x-6x3x", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insufficient resource isolation and uncontrolled resource consumption. The service relies solely on an application-level soft limit (a 500ms polling interval) for memory management and lacks strict OS-level constraints such as cgroups or kernel-level namespaces. This architectural weakness allows attackers to easily bypass memory checks via time-window attacks, or exhaust the entire JavaScript worker pool via concurrent CPU-intensive requests, resulting in a complete Denial of Service (DoS) for legitimate users. At time of publication, there are no publicly available patches."}, {"lang": "es", "value": "FastGPT es una plataforma de creaci\u00f3n de agentes de IA. En las versiones 4.14.13 y anteriores, el componente code-sandbox sufre de aislamiento de recursos insuficiente y consumo de recursos incontrolado. El servicio se basa \u00fanicamente en un l\u00edmite flexible a nivel de aplicaci\u00f3n (un intervalo de sondeo de 500 ms) para la gesti\u00f3n de la memoria y carece de restricciones estrictas a nivel de sistema operativo, como cgroups o espacios de nombres a nivel de kernel. Esta debilidad arquitect\u00f3nica permite a los atacantes eludir f\u00e1cilmente las comprobaciones de memoria mediante ataques de ventana de tiempo, o agotar todo el pool de trabajadores de JavaScript mediante solicitudes concurrentes que consumen mucha CPU, lo que resulta en una Denegaci\u00f3n de Servicio (DoS) completa para los usuarios leg\u00edtimos. En el momento de la publicaci\u00f3n, no hay parches disponibles p\u00fablicamente."}], "lastModified": "2026-07-24T21:10:00.143", "sourceIdentifier": "security-advisories@github.com"}