CVE-2026-84301: FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress() before a later HTTP connection performs an independent DNS lookup, creating a DNS rebinding window, allowing an attacker-controlled hostname to resolve publicly during the check and to a loopback, private, link-local, or metadata address during connection. An authenticated attacker who can supply a URL to a safe-Axios-backed HTTP tool, workflow HTTP node, external file fetch, or other server-side integration can use this time-of-check/time-of-use gap to reach services that direct private-address inputs would block. The same independent re-resolution occurs after manual redirect hops because each redirect target is checked before a separate connection lookup. This issue is fixed in version 4.15.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FastGPTto a version that resolves this vulnerability.Fixed in 4.15.2
Event History
Frequently Asked Questions
Which deployments are exposed?
FastGPT versions prior to 4.15.2 are exposed where an authenticated user can supply a URL to a server-side feature backed by safe Axios, including HTTP tools, workflow HTTP nodes, external file fetching, or other server-side integrations.
What must an attacker be able to do?
The attacker needs authenticated access and the ability to provide an attacker-controlled hostname as a URL to an affected server-side request feature. They must also control DNS responses so the hostname resolves to a public address during validation and to an internal address when the HTTP connection is made.
Are redirects relevant to exploitation?
Yes. Redirect targets are validated and then resolved again for connection, so the same DNS rebinding window exists after manual redirect hops.
What is the available remediation?
Upgrade FastGPT to version 4.15.2, which fixes the issue.