| शीर्षक | 2fastlabs Agent Squad 1.1.0 Denial of Service |
|---|
| विवरण | Agent Squad TypeScript 1.1.0 has a denial of service vulnerability in the streaming agent response workflow.
When an agent returns a streamed response, AgentSquad.routeRequest() returns the stream to the caller but also continues consuming the full provider stream in a background task. That task accumulates all chunks in memory and stores the complete response after the stream ends.
Because client cancellation is not propagated and no stream chunk, byte, or accumulated response size limit is enforced, a prompt-influenced task can cause a long streamed response to keep running after the client disconnects.This can exhaust model/streaming resources, Node.js memory, buffers, and storage, making normal chat or API requests unavailable. |
|---|
| स्रोत | ⚠️ https://github.com/hackerguopeng/cve/tree/main/Agent_Squad_Streaming_Background_DoS_Report |
|---|
| उपयोगकर्ता | hackerguopeng (UID 99623) |
|---|
| सबमिशन | 10/07/2026 06:29 AM (2 महीनों पहले) |
|---|
| संयम | 03/09/2026 07:05 AM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 398311 [2FastLabs agent-squad तक 1.1.4 Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest सेवा अस्वीकार] |
|---|
| अंक | 0 |
|---|