CVE-2026-85100

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85100
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85100.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85100
Published
2026-09-03T09:45:15.137Z
Modified
2026-09-05T03:48:34.320989677Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumption
Details

A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/orchestrator.ts of the component Streaming Agent Response Workflow. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85100.json",
    "cwe_ids": [
        "CWE-400",
        "CWE-404"
    ],
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/2fastlabs/agent-squad

Affected ranges

Type
GIT
Repo
https://github.com/2fastlabs/agent-squad
Events
Introduced
1a8ea472a8600e6e582b314e82de49a294407e8c
Last affected
c9b05f9e67d7a106d89e7c8170ba66e1b84777a3
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.1.0"
        },
        {
            "last_affected": "1.1.0"
        },
        {
            "introduced": "1.1.1"
        },
        {
            "last_affected": "1.1.1"
        },
        {
            "introduced": "1.1.2"
        },
        {
            "last_affected": "1.1.2"
        },
        {
            "introduced": "1.1.3"
        },
        {
            "last_affected": "1.1.3"
        },
        {
            "introduced": "1.1.4"
        },
        {
            "last_affected": "1.1.4"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
python_1.*
python_1.1.0
python_1.1.1
python_1.1.2
python_1.1.3
python_v1.*
python_v1.1.3
typescript_1.*
typescript_1.1.0
typescript_1.1.2
typescript_1.1.3
typescript_1.1.4
typescript_v1.*
typescript_v1.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85100.json"