What’s Vulnerable › Vulnerabilities

CVE-2026-42343: FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion

• Severity: medium (CVSS 6.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-08 · updated 2026-07-24
• Weakness: CWE-400

Description

FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insufficient resource isolation and uncontrolled resource consumption. The service relies solely on an application-level soft limit (a 500ms polling interval) for memory management and lacks strict OS-level constraints such as cgroups or kernel-level namespaces. This architectural weakness allows attackers to easily bypass memory checks via time-window attacks, or exhaust the entire JavaScript worker pool via concurrent CPU-intensive requests, resulting in a complete Denial of Service (DoS) for legitimate users. At time of publication, there are no publicly available patches.

Affected products

• labring FastGPT: through 4.14.13

References

• https://github.com/labring/FastGPT/security/advisories/GHSA-qv7v-r94x-6x3x
• https://github.com/labring/FastGPT/security/advisories/GHSA-qv7v-r94x-6x3x

Get alerted when CVE-2026-42343 or the next vulnerability affects your stack