CVE-2026-42344

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts is vulnerable to DNS rebinding (TOCTOU — Time-of-Check to Time-of-Use). The function resolves the hostname via dns.resolve4()/dns.resolve6() and checks resolved IPs against private ranges, but the actual HTTP request happens in a separate call with a new DNS resolution, allowing the DNS record to change between validation and fetch. At time of publication, there are no publicly available patches.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/labring/FastGPT/security/advisories/GHSA-cc8x-jrqv-hmwh
https://github.com/labring/FastGPT/security/advisories/GHSA-cc8x-jrqv-hmwh

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-08 23:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-42344

Mitre link : CVE-2026-42344

CVE.ORG link : CVE-2026-42344

JSON object : View

Products Affected

No product.

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2026-42344", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42344", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T18:03:09.390132Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "labring", "product": "FastGPT", "versions": [{"status": "affected", "version": "<= 4.14.11"}]}]}], "published": "2026-05-08T23:16:37.177", "references": [{"url": "https://github.com/labring/FastGPT/security/advisories/GHSA-cc8x-jrqv-hmwh", "source": "security-advisories@github.com"}, {"url": "https://github.com/labring/FastGPT/security/advisories/GHSA-cc8x-jrqv-hmwh", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts is vulnerable to DNS rebinding (TOCTOU \u2014 Time-of-Check to Time-of-Use). The function resolves the hostname via dns.resolve4()/dns.resolve6() and checks resolved IPs against private ranges, but the actual HTTP request happens in a separate call with a new DNS resolution, allowing the DNS record to change between validation and fetch. At time of publication, there are no publicly available patches."}, {"lang": "es", "value": "FastGPT es una plataforma de creaci\u00f3n de agentes de IA. En las versiones 4.14.11 y anteriores, la funci\u00f3n isInternalAddress() de FastGPT en packages/service/common/system/utils.ts es vulnerable a la reencuadernaci\u00f3n de DNS (TOCTOU - Tiempo de verificaci\u00f3n a tiempo de uso). La funci\u00f3n resuelve el nombre de host a trav\u00e9s de dns.resolve4()/dns.resolve6() y verifica las IP resueltas contra rangos privados, pero la solicitud HTTP real ocurre en una llamada separada con una nueva resoluci\u00f3n de DNS, lo que permite que el registro DNS cambie entre la validaci\u00f3n y la recuperaci\u00f3n. En el momento de la publicaci\u00f3n, no hay parches disponibles p\u00fablicamente."}], "lastModified": "2026-07-24T21:10:00.143", "sourceIdentifier": "security-advisories@github.com"}