FastGPT, an AI Agent building platform by labring, suffers from uncontrolled resource consumption in its code-sandbox component in versions up to 4.14.13. The vulnerability arises because the service uses only a 500ms polling interval as a soft limit for memory management without enforcing strict OS-level resource constraints such as cgroups or kernel namespaces. Attackers can exploit this design by launching concurrent CPU-intensive requests or timing attacks to bypass memory checks, exhausting the JavaScript worker pool and causing a complete Denial of Service.

Successful exploitation results in a Denial of Service, where legitimate users are unable to use FastGPT due to resource exhaustion. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing external resource limits at the OS or container level to mitigate risk. Monitoring and limiting concurrent CPU-intensive requests may help reduce impact but are not guaranteed to fully prevent exploitation.