FastGPT
CVE-2026-42343
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insufficient resource isolation and uncontrolled resource consumption. The service relies solely on an application-level soft limit (a 500ms polling interval) for memory management and lacks strict OS-level constraints such as cgroups or kernel-level namespaces. This architectural weakness allows attackers to easily bypass memory checks via time-window attacks, or exhaust the entire JavaScript worker pool via concurrent CPU-intensive requests, resulting in a complete Denial of Service (DoS) for legitimate users. At time of publication, there are no publicly available patches.
AnalysisAI
Denial of service vulnerability in FastGPT 4.14.13 and prior affects the code-sandbox component due to insufficient resource isolation and reliance on weak application-level memory limits. Unauthenticated remote attackers can trigger complete service unavailability by launching time-window memory attacks or exhausting the JavaScript worker pool via concurrent CPU-intensive requests. Attack complexity is reported as low with attack timing considerations (AT:P), and no vendor-released patch is available at time of publication.
Technical ContextAI
FastGPT's code-sandbox component is responsible for safely executing user-provided code in an isolated environment. However, the implementation relies solely on application-level soft limits-specifically a 500ms polling interval for memory management-rather than OS-level resource constraints such as cgroups (Linux control groups) or kernel-level namespaces. This architectural approach leaves the service vulnerable to resource exhaustion attacks. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause: the absence of proper rate limiting, quota enforcement, or hard resource boundaries allows attackers to consume memory and CPU beyond intended limits. The JavaScript worker pool, used to execute sandboxed code, can be completely exhausted by coordinated concurrent requests, leaving no capacity for legitimate users.
RemediationAI
No vendor-released patch is available at time of publication. Immediate mitigation requires implementing OS-level resource constraints independent of the application: deploy FastGPT code-sandbox workers within cgroups-managed containers (Linux) with explicit CPU and memory quotas, use Kubernetes resource requests/limits to enforce pod-level constraints, or isolate workers in separate virtual machines with hard resource boundaries. Additionally, implement application-level rate limiting on code execution requests at the API layer to prevent concurrent request flooding, set strict timeouts (significantly shorter than 500ms) for code execution with immediate worker termination on timeout, and monitor JavaScript worker pool utilization with alerting on threshold breach. Disable or restrict access to the code-sandbox feature entirely if it is not critical to operations, as this provides the strongest mitigation. Each control has trade-offs: OS-level isolation reduces attack surface but increases infrastructure complexity and may increase latency; application-level rate limiting protects availability but may degrade user experience during legitimate load. Users should monitor the GitHub advisory at https://github.com/labring/FastGPT/security/advisories/GHSA-qv7v-r94x-6x3x for patch availability.
FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t
Unauthenticated HTTP proxy abuse in FastGPT (AI Agent platform) prior to v4.14.9.5 allows remote attackers to relay arbi
Remote code execution in FastGPT's agent-sandbox component (versions 4.14.10 through 4.14.12) lets any network-adjacent,
NoSQL injection in FastGPT <4.14.9.5 password authentication allows unauthenticated remote attackers to bypass login con
GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request
NoSQL injection in FastGPT versions before 4.14.9.5 allows authenticated attackers to bypass password verification on th
Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugi
Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by
Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI
Server-Side Request Forgery in Labring FastGPT prior to 4.15.0-beta1 lets an authenticated attacker bypass the platform'
Server-side request forgery in FastGPT (labring) versions 4.14.11 and prior lets a low-privileged user coerce the server
Server-Side Request Forgery (SSRF) in FastGPT's Model Context Protocol (MCP) tools endpoints allows authenticated attack
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today