CVE-2026-42343: FastGPT code-sandbox denial of service through unrestricted resource consumption

Summary

CVE-2026-42343 affects FastGPT, an AI Agent building platform, in versions 4.14.13 and prior. Its code-sandbox component relies only on an application-level soft limit, a 500ms polling interval, for memory management and lacks OS-level constraints such as cgroups or kernel-level namespaces. Attackers can bypass memory checks through time-window attacks or exhaust the JavaScript worker pool with concurrent CPU-intensive requests, causing a complete Denial of Service for legitimate users.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• AI agents

Related items

• HighCVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpointSimilar attack · NVD/CVE Database
• MediumCVE-2026-83494: training-operator immutability check bypass in PyTorchJob ValidateUpdate webhookSimilar attack · NVD/CVE Database
• CriticalCVE-2026-48705: MONAI PydicomReader affine computation accepts non-finite DICOM valuesSimilar attack · NVD/CVE Database
• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence