Vulnerability Description
FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insufficient resource isolation and uncontrolled resource consumption. The service relies solely on an application-level soft limit (a 500ms polling interval) for memory management and lacks strict OS-level constraints such as cgroups or kernel-level namespaces. This architectural weakness allows attackers to easily bypass memory checks via time-window attacks, or exhaust the entire JavaScript worker pool via concurrent CPU-intensive requests, resulting in a complete Denial of Service (DoS) for legitimate users. At time of publication, there are no publicly available patches.
Related Weaknesses (CWE)
References
- https://github.com/labring/FastGPT/security/advisories/GHSA-qv7v-r94x-6x3x
- https://github.com/labring/FastGPT/security/advisories/GHSA-qv7v-r94x-6x3x
FAQ
What is CVE-2026-42343?
CVE-2026-42343 is a documented vulnerability. FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insufficient resource isolation and uncontrolled resource consumption. The service reli...
How severe is CVE-2026-42343?
CVSS scoring is not yet available for CVE-2026-42343. Check NVD for updates.
Is there a patch for CVE-2026-42343?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.