---
id: "CVE-2026-118128"
kind: "vulnerability"
aliases: ["CVE-2026-118128"]
title: "a2a-js: race condition in task status updates before 1.2.0"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["a2a-js", "agent-to-agent", "node", "package"]
not_affected_if: []
published_at: "2026-10-27T23:16:58+00:00"
first_seen_at: "2026-10-27T23:29:42+00:00"
updated_at: "2026-10-27T23:31:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118128", "first_seen_at": "2026-10-27T23:29:42+00:00"}]
---

# a2a-js: race condition in task status updates before 1.2.0

The a2a-js library's ResultManager.applyStatusUpdate function in src/server/result_manager.ts has a race condition when handling task status updates. The sources do not say what an attacker can gain beyond disturbing task state.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed a2a-js version in the project with `npm ls @a2a-js/sdk` or by reading the lockfile, and look for versions up to `1.1.0`.

## Fix

- Upgrade a2a-js to `1.2.0` or later, per the sources (patch commit 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25).

## Timeline

- 2026-10-27T23:29:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118128

## From the sources

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_