Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts is vulnerable to DNS rebinding (TOCTOU — Time-of-Check to Time-of-Use). The function resolves the hostname via dns.resolve4()/dns.resolve6() and checks resolved IPs against private ranges, but the actual HTTP request happens in a separate call with a new DNS resolution, allowing the DNS record to change between validation and fetch. At time of publication, there are no publicly available patches.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-42344 FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts is vulnerab… https://www.cve.org/CVERecord?id=CVE-2026-42344
Post summary
The post announces CVE‑2026‑42344 affecting FastGPT’s isInternalAddress() function, but provides no detailed technical information, PoC, exploit, or patch details.
CVE-2026-42344 DNS Rebinding Vulnerability in FastGPT 4.14.11 and Prior Versions https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42344
Post summary
A DNS rebinding vulnerability affecting FastGPT 4.14.11 and earlier versions has been disclosed, with references to details but without PoC, exploit code, or patch information.