CVE-2026-85100 Details

A denial-of-service vulnerability has been identified in 2FastLabs Agent Squad versions through 1.1.4. The issue arises in the streaming agent response workflow, specifically within the TypeScript package. When an agent provides a streaming response, the 'routeRequest' function initiates background processing that continues to consume and accumulate the streamed data even after the client has disconnected. This unchecked resource consumption can lead to memory exhaustion, causing the application to become unavailable.

To address this vulnerability, it is recommended to implement an 'AbortSignal' or a framework-level cancellation token to 'routeRequest()', 'processRequest()', and provider calls. Additionally, enforce limits on stream chunks, bytes, and accumulated response bytes. After exceeding these limits, return a bounded error and store only capped content or a summary in conversation storage. Finally, add per-user, per-session, and global streaming concurrency limits.