{"id":"CVE-2026-120234","kind":"vulnerability","aliases":["CVE-2026-120234"],"related":[],"title":"ag-ui TypeScript client: a malicious server's huge HTTP error response can exhaust the client's memory","description":"A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.","summary":"The @ag-ui/client TypeScript HTTP transport reads the whole body of any non-2xx response with e.text() with no size cap, then keeps it twice (in the Error message and on error.payload). The reporter measured 46.6 MB of heap growth from a 50 MB error body. The flaw is on the client side: an endpoint the agent connects to, or one an attacker controls, can return a huge error and run the client out of memory. A public PoC is in the issue. The fix, PR #2698, is open and not merged.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@ag-ui/client","fixed":[],"affected":"<= 0.0.58","ecosystem":"npm"}],"ecosystems":[],"tags":["ag-ui","ag-ui-protocol","ai-agents","ai-tooling","client-side","denial-of-service","http-transport","npm"],"not_affected_if":["trusted-endpoints-only"],"how_to_check":"Run 'npm ls @ag-ui/client' (or check your lock file). Version 0.0.58 and earlier are listed as affected. You are exposed if an HttpAgent connects to an endpoint you do not fully control. The issue's PoC (node poc_f27.mjs against @ag-ui/client@0.0.58) reproduces it. Also check any wrapper that depends on @ag-ui/client.","fix":null,"status":"open","published_at":"2026-11-01T16:18:14+00:00","first_seen_at":"2026-11-01T16:20:45+00:00","triaged_at":"2026-11-01T16:22:52+00:00","updated_at":"2026-11-01T16:23:58+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-01T16:22:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ag-ui: HTTP transport flaw lets remote attackers consume resources","impact":"medium","summary":"The ag-ui-protocol ag-ui package up to version 0.0.58 has a weakness in the e.text function of its HTTP Transport component. A remote attacker can manipulate it to consume server resources, and a public exploit is available.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["ag-ui","ag-ui-protocol","ai-agents","http-transport"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"Remote requests exhaust server resources, causing slowdown or denial of service.","analyst_note":"Confirm which HTTP Transport code path is reachable by default and whether a fixed release exists, since the pull request is still awaiting acceptance; check the NVD entry and the upstream ag-ui repository.","how_to_check":"- Check the installed `ag-ui-protocol` version in your lock file or dependency manifest; the sources list `0.0.58` and earlier as affected.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources name the HTTP Transport component of ag-ui-protocol ag-ui up to 0.0.58, so teams that run this package with HTTP transport are the ones to look at. The sources do not say which configurations or request paths reach the affected function, or whether a default setup is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001248,"input_tokens":4138,"output_tokens":1669,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Confirm which HTTP Transport code path is reachable by default and whether a fixed release exists, since the pull request is still awaiting acceptance; check the NVD entry and the upstream ag-ui repository.","search":"'-120234':22A,25A '-2026':21A,24A '/client':29A,58B '0.0.58':164C '2698':143B '2xx':70B '46.6':92B '50':99B 'accept':212C 'ag':2A,27A,31B,34B,56B,156C,160C 'ag-ui':1A,26A,30B,55B,159C 'ag-ui-protocol':33B,155C 'agent':39B,113B 'ai':38B,41B 'ai-ag':37B 'ai-tool':40B 'attack':119B,184C,203C 'avail':194C 'await':211C 'bodi':65B,102B 'cap':77B 'client':5A,17A,44B,108B,129B 'client-sid':43B 'compon':172C 'connect':114B 'consumpt':182C 'control':120B 'could':199C 'cve':20A,23A 'denial':47B 'denial-of-servic':46B 'e.text':73B,169C 'endpoint':111B 'error':12A,84B,101B,125B 'error.payload':88B 'execut':175C 'exhaust':15A 'exploit':190C 'fix':141B,208C 'flaw':104B 'function':168C 'growth':96B 'heap':95B 'http':11A,51B,60B,173C 'http-transport':50B 'huge':10A,124B 'identifi':153C 'impact':166C 'issu':139B,210C 'keep':79B 'launch':187C 'lead':179C 'made':193C 'malici':7A 'manipul':177C 'mb':93B,100B 'measur':91B 'memori':19A,132B 'merg':148B 'messag':85B 'non':69B 'non-2xx':68B 'npm':53B 'one':117B 'open':145B 'poc':135B 'pr':142B 'protocol':36B,158C 'public':134B,197C 'pull':205C 'read':62B 'remot':188C 'report':90B 'request':206C 'resourc':181C 'respons':13A,71B 'return':122B 'run':127B 'server':8A 'servic':49B 'side':45B,109B 'size':76B 'tool':42B 'transport':52B,61B,174C 'twice':81B 'typescript':4A,59B 'ui':3A,28A,32B,35B,57B,157C,161C 'use':201C 'weak':150C 'whole':64B","nicknames":[],"mitigations":[],"who_affected":"Apps that use the @ag-ui/client HttpAgent (Node or browser) to call agent endpoints. The risk is a hostile or compromised endpoint, or a man-in-the-middle, returning a very large non-2xx body that exhausts the client's memory. The error text also reaches onRunFailed, UIs and logs. Setups where the client only talks to a server you fully control can mostly skip it. The NVD entry says 'ag-ui up to 0.0.58' without naming the package; the issue names the npm package @ag-ui/client.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T16:18:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-120234","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120234","severity":null,"published_at":"2026-11-01T16:18:14+00:00","modified_at":"2026-11-01T16:18:14+00:00","first_seen_at":"2026-11-01T16:20:45+00:00","fetched_at":"2026-11-01T16:20:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120234:1309","url":null,"severity":null,"published_at":"2026-11-01T16:23:58+00:00","modified_at":"2026-11-01T16:23:58+00:00","first_seen_at":"2026-11-01T16:23:58+00:00","fetched_at":"2026-11-01T16:23:58+00:00","note":"NVD (VulDB) CVE is for issue #2521: unbounded e.text() on the error path in @ag-ui/client 0.0.58, client-side memory exhaustion rather than a server flaw. Maintainer approved the fix scope; PR #2698 (64 KiB preview cap) is still open, unmerged, no release. Not checked: whether other versions or package names are affected, or the npm registry for a newer release. Nothing marked verified. Title rewritten."}],"documents":[{"id":39715,"url":"https://github.com/ag-ui-protocol/ag-ui/issues/2521","title":"ag-ui #2521: unbounded e.text() on HTTP error path (with PoC)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":39716,"url":"https://github.com/ag-ui-protocol/ag-ui/pull/2698","title":"ag-ui PR #2698: bound HTTP error response previews (open, unmerged)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}