CVE-2026-42344

6.3 Moyenne

Publiée le 09/05/2026 à 01:16 · Modifiée le 24/07/2026 à 23:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts is vulnerable to DNS rebinding (TOCTOU — Time-of-Check to Time-of-Use). The function resolves the hostname via dns.resolve4()/dns.resolve6() and checks resolved IPs against private ranges, but the actual HTTP request happens in a separate call with a new DNS resolution, allowing the DNS record to change between validation and fetch. At time of publication, there are no publicly available patches.

Traduire en français

Produits concernés

labring FastGPT

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.3 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-367

Références

https://github.com/labring/FastGPT/security/advisories/GHSA-cc8x-jrqv-hmwh
https://github.com/labring/FastGPT/security/advisories/GHSA-cc8x-jrqv-hmwh

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories