CVE-2026-42343
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
FastGPT versions up to 4.14.13 have weak resource isolation in the code-sandbox component. Lack of strict OS-level constraints (e.g., cgroups) allows attackers to bypass memory checks and exhaust the JavaScript worker pool, causing a complete Denial of Service (DoS).
Risk Assessment
The organization risks complete unavailability of the FastGPT service, blocking legitimate users.
Recommendation
Immediately upgrade FastGPT to a patched version when available, and consider adding container-level restrictions.
Original NVD description (English source)
FastGPT is an AI Agent building platform. In versions 4.14.13 and prior, the code-sandbox component suffers from insufficient resource isolation and uncontrolled resource consumption. The service relies solely on an application-level soft limit (a 500ms polling interval) for memory management and lacks strict OS-level constraints such as cgroups or kernel-level namespaces. This architectural weakness allows attackers to easily bypass memory checks via time-window attacks, or exhaust the entire JavaScript worker pool via concurrent CPU-intensive requests, resulting in a complete Denial of Service (DoS) for legitimate users. At time of publication, there are no publicly available patches.