CVE-2026-42344
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
FastGPT versions up to 4.14.11 are vulnerable to DNS rebinding (TOCTOU) in the isInternalAddress() function. The function checks the IP before the HTTP request, but a new DNS resolution during the request may return a different address, bypassing validation. No public patches available.
Risk Assessment
An attacker can bypass internal address checks and access private network resources, potentially leading to data leakage or further compromise.
Recommendation
Monitor FastGPT updates and apply temporary mitigations such as restricting API access or using fixed IP addresses.
Original NVD description (English source)
FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts is vulnerable to DNS rebinding (TOCTOU — Time-of-Check to Time-of-Use). The function resolves the hostname via dns.resolve4()/dns.resolve6() and checks resolved IPs against private ranges, but the actual HTTP request happens in a separate call with a new DNS resolution, allowing the DNS record to change between validation and fetch. At time of publication, there are no publicly available patches.