CVE-2026-42344 Details
Description
FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts is vulnerable to DNS rebinding (TOCTOU — Time-of-Check to Time-of-Use). The function resolves the hostname via dns.resolve4()/dns.resolve6() and checks resolved IPs against private ranges, but the actual HTTP request happens in a separate call with a new DNS resolution, allowing the DNS record to change between validation and fetch. At time of publication, there are no publicly available patches.
A vulnerability in FastGPT versions through 4.14.11 allows for DNS rebinding attacks that bypass private IP checks, leading to server-side request forgery (SSRF) on protected endpoints. The issue arises in the isInternalAddress() function, which validates resolved IPs against private ranges but fails to maintain this validation during the actual HTTP request, allowing attackers to exploit the timing of DNS resolutions. This vulnerability affects all endpoints that utilize the isInternalAddress() function, enabling access to cloud metadata and internal services.
Users are advised to implement DNS pinning by resolving the hostname once, checking the IP against internal ranges, and then using the resolved IP for the HTTP connection. Alternatively, a secure HTTP client that performs DNS pinning can be used.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/labring/FastGPT/security/advisories/GHSA-cc8x-jrqv-hmwh | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/labring/FastGPT/security/advisories/GHSA-cc8x-jrqv-hmwh | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| labring FastGPT | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |