---
id: CVE-2026-84301
title: >-
  FastGPT is an open-source LLM platform for building AI applications on a
  knowledge base
summary: >-
  FastGPT is an open-source LLM platform for building AI applications on a
  knowledge base. Prior to 4.15.2, the safe Axios request interceptor in
  packages/service/common/api/axios.ts validates a hostname with
  isInternalAddress() before a l…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-918
vendor: labring
product: FastGPT
affected:
  - FastGPT < 4.15.2
published: '2026-09-22'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T00:16:37.243'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84301'
references:
  - url: >-
      https://github.com/labring/FastGPT/commit/0a38565c9d1f790045636bd9d55f8d2296c938c7
    label: security-advisories@github.com
  - url: 'https://github.com/labring/FastGPT/pull/7261'
    label: security-advisories@github.com
  - url: 'https://github.com/labring/FastGPT/releases/tag/v4.15.2'
    label: security-advisories@github.com
  - url: 'https://github.com/labring/FastGPT/security/advisories/GHSA-6jwp-qf29-hpj9'
    label: security-advisories@github.com
  - url: 'https://github.com/labring/FastGPT/security/advisories/GHSA-6jwp-qf29-hpj9'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-25T23:45:14.745715Z'
epss: 0.00363
epssPercentile: 0.2747
ingestedAt: '2026-09-22T17:07:07.379Z'
---

## Overview

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress() before a later HTTP connection performs an independent DNS lookup, creating a DNS rebinding window, allowing an attacker-controlled hostname to resolve publicly during the check and to a loopback, private, link-local, or metadata address during connection. An authenticated attacker who can supply a URL to a safe-Axios-backed HTTP tool, workflow HTTP node, external file fetch, or other server-side integration can use this time-of-check/time-of-use gap to reach services that direct private-address inputs would block. The same independent re-resolution occurs after manual redirect hops because each redirect target is checked before a separate connection lookup. This issue is fixed in version 4.15.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.