CVE-2026-85100
2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumption
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/orchestrator.ts of the component Streaming Agent Response Workflow. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-400 CWE-404 |
| Vendor | 2fastlabs |
| Product | agent-squad |
| Published | Sep 3, 2026 |
| Last Updated | Sep 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for 2fastlabs agent-squad
Be the first to know when new medium vulnerabilities affecting 2fastlabs agent-squad are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
2FastLabs / agent-squad
1.1.0 1.1.1 1.1.2 1.1.3 1.1.4
References
vuldb.com: https://vuldb.com/vuln/398311 vuldb.com: https://vuldb.com/vuln/398311/cti vuldb.com: https://vuldb.com/cve/CVE-2026-85100 vuldb.com: https://vuldb.com/submit/884960 vuldb.com: https://vuldb.com/submit/884961 github.com: https://github.com/2FastLabs/agent-squad/issues/661 github.com: https://github.com/hackerguopeng/cve/tree/main/Agent_Squad_Streaming_Background_DoS_Report github.com: https://github.com/2FastLabs/agent-squad/
Credits
🔍 hackerguopeng (VulDB User) VulDB CNA Team