How many CVEs have patched async?

4 published CVEs changed async in labring/FastGPT, in 5 distinct patches totalling 33 changed lines, between 2026 and 2026.

What is the latest CVE that changed async?

CVE-2026-61644 (FastGPT: /api/core/chat/record/getCollectionQuote can disclose cross-tenant dataset text due to an unbound initialId lookup), published 2026-07-15, changed lines 615 to 619 of packages/service/core/ai/llm/agentLoop/loop/base.ts.

How does async compare to the rest of labring/FastGPT?

labring/FastGPT has 17 CVEs with a located fix in total; 4 of them changed async.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

async in labring/FastGPT: Patched by 4 CVEs

FastGPT: /api/core/chat/record/getCollectionQuote can disclose cross-tenant dataset text due to an unbound initialId lookup

CVE-2026-61644 · packages/service/core/ai/llm/agentLoop/loop/base.ts · lines 615–619 · +2 −3

High · CVSS 7.7

EPSS 0.4%2026-07-15

FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord

CVE-2026-54602 · packages/service/core/ai/llm/agentLoop/loop/unified.ts · line 279 · +2 −2 in 2 hunks

High · CVSS 7.1

EPSS 0.4%2026-07-07

FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover

CVE-2026-40352 · projects/app/src/pages/chat/index.tsx · line 124 · +2 −2 in 2 hunks

High · CVSS 8.8

EPSS 0.5%2026-04-17

FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover

CVE-2026-40352 · projects/app/src/pages/login/index.tsx · line 23 · +2 −2 in 2 hunks

High · CVSS 8.8

EPSS 0.5%2026-04-17

FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover

CVE-2026-40352 · projects/app/src/pages/login/provider.tsx · line 43 · +2 −2 in 2 hunks

High · CVSS 8.8

EPSS 0.5%2026-04-17

FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass

CVE-2026-40351 · projects/app/src/pages/chat/index.tsx · line 124 · +2 −2 in 2 hunks

Critical · CVSS 9.8

EPSS 0.6%2026-04-17

FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass

CVE-2026-40351 · projects/app/src/pages/login/index.tsx · line 23 · +2 −2 in 2 hunks

Critical · CVSS 9.8

EPSS 0.6%2026-04-17

FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass

CVE-2026-40351 · projects/app/src/pages/login/provider.tsx · line 43 · +2 −2 in 2 hunks

Critical · CVSS 9.8

EPSS 0.6%2026-04-17

async

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track labring/FastGPT CVEs