Live › vulnerability › CVE-2026-118128
Go to dashboardThe a2a-js library's ResultManager.applyStatusUpdate function in src/server/result_manager.ts has a race condition when handling task status updates. The sources do not say what an attacker can gain beyond disturbing task state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Teams running a server built on a2a-js 1.1.0 or earlier that handles task status updates from remote clients. Applications that only use the library as a client, or that do not run the affected server handler, are less likely to be exposed, but the sources do not confirm this. The sources do not say which deployment shapes are most at risk.
No product ranges from the sources yet.
npm ls @a2a-js/sdk or by reading the lockfile, and look for versions up to 1.1.0.1.2.0 or later, per the sources (patch commit 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-118128")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.