CVE-2026-42343
Last modified
CVE-2026-42343 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insufficient resource isolation and uncontrolled resource consumption. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insufficient resource isolation and uncontrolled resource consumption. The service relies solely on an application-level soft limit (a 500ms polling interval) for memory management and lacks strict OS-level constraints such as cgroups or kernel-level namespaces. This architectural weakness allows attackers to easily bypass memory checks via time-window attacks, or exhaust the entire JavaScript worker pool via concurrent CPU-intensive requests, resulting in a complete Denial of Service (DoS) for legitimate users. At time of publication, there are no publicly available patches.
Metrics
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-42343?
How severe is CVE-2026-42343?
How do I fix CVE-2026-42343?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-42337MaxKB is an open-source AI assistant for enterprise. MaxKB 2…5.3
- CVE-2026-42338ip-address is a library for parsing and manipulating IPv4 an…6.1
- CVE-2026-42339New API is a large language mode (LLM) gateway and artificia…7.1
- CVE-2026-4234A security flaw has been discovered in SSCMS 7.4.0. This vul…6.3
- CVE-2026-42341FOSSBilling is a free, open-source billing and client manage…9.2
- CVE-2026-42342React Router is a router for React. In versions 7.0.0 throug…7.5
- CVE-2026-42344FastGPT is an AI Agent building platform. In versions 4.14.1…6.3
- CVE-2026-42345FastGPT is an AI Agent building platform. In versions 4.14.1…7.7
- CVE-2026-42346Postiz is an AI social media scheduling tool. From version 2…6.5
- CVE-2026-42347Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
- CVE-2026-42348OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelem…7.5
- CVE-2026-42349Clerk JavaScript is the official JavaScript repository for C…8.1
Are you affected by CVE-2026-42343?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST