CVE-2026-84301

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.15.2

Description A DNS rebinding issue exists in the safe Axios request interceptor located in packages/service/common/api/axios.ts. The system validates a hostname using the isInternalAddress() function before the HTTP connection performs a separate DNS lookup. This creates a time-of-check/time-of-use gap, allowing an attacker-controlled hostname to resolve to a public address during validation and then resolve to a loopback, private, link-local, or metadata address during the actual connection. An authenticated attacker can exploit this by providing a URL to a safe-Axios-backed HTTP tool, workflow HTTP node, external file fetch, or other server-side integrations to access services that would normally block private-address inputs. This behavior also occurs during manual redirect hops, as each target is validated before a new connection lookup.

Recommendations Update to version 4.15.2.