CVE-2026-85100: 2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumption
A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/orchestrator.ts of the component Streaming Agent Response Workflow. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require authenticated access?
Yes. The supplied CVSS vector indicates low privileges are required, while no user interaction is needed. The attack can be launched remotely.
What is the expected security impact?
The reported impact is resource consumption causing low availability impact. No confidentiality or integrity impact is identified in the supplied CVSS vector.
How should affected deployments be prioritized?
Deployments running 2FastLabs agent-squad versions up to 1.1.4 should be prioritized, particularly where low-privileged remote users can reach the Streaming Agent Response Workflow. A public exploit is reported to be available.
Is a vendor fix or workaround identified?
No fix or workaround is provided in the available data. The project was reportedly notified through an issue report but had not responded at the time of reporting.