---
id: "CVE-2026-120234"
kind: "vulnerability"
aliases: ["CVE-2026-120234"]
title: "ag-ui TypeScript client: a malicious server's huge HTTP error response can exhaust the client's memory"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "@ag-ui/client", "fixed": [], "affected": "<= 0.0.58", "ecosystem": "npm"}]
ecosystems: []
tags: ["ag-ui", "ag-ui-protocol", "ai-agents", "ai-tooling", "client-side", "denial-of-service", "http-transport", "npm"]
not_affected_if: ["trusted-endpoints-only"]
published_at: "2026-11-01T16:18:14+00:00"
first_seen_at: "2026-11-01T16:20:45+00:00"
updated_at: "2026-11-01T16:23:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120234", "first_seen_at": "2026-11-01T16:20:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T16:23:58+00:00"}]
---

# ag-ui TypeScript client: a malicious server's huge HTTP error response can exhaust the client's memory

The @ag-ui/client TypeScript HTTP transport reads the whole body of any non-2xx response with e.text() with no size cap, then keeps it twice (in the Error message and on error.payload). The reporter measured 46.6 MB of heap growth from a 50 MB error body. The flaw is on the client side: an endpoint the agent connects to, or one an attacker controls, can return a huge error and run the client out of memory. A public PoC is in the issue. The fix, PR #2698, is open and not merged.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@ag-ui/client affected <= 0.0.58 fixed ?

## How to check

Run 'npm ls @ag-ui/client' (or check your lock file). Version 0.0.58 and earlier are listed as affected. You are exposed if an HttpAgent connects to an endpoint you do not fully control. The issue's PoC (node poc_f27.mjs against @ag-ui/client@0.0.58) reproduces it. Also check any wrapper that depends on @ag-ui/client.

## Timeline

- 2026-11-01T16:20:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120234
- 2026-11-01T16:23:58+00:00 analyst — NVD (VulDB) CVE is for issue #2521: unbounded e.text() on the error path in @ag-ui/client 0.0.58, client-side memory exhaustion rather than a server flaw. Maintainer approved the fix scope; PR #2698 (64 KiB preview cap) is still open, unmerged, no release. Not checked: whether other versions or package names are affected, or the npm registry for a newer release. Nothing marked verified. Title rewritten.

## Documents

- [fix] ag-ui PR #2698: bound HTTP error response previews (open, unmerged) https://github.com/ag-ui-protocol/ag-ui/pull/2698
- [poc] ag-ui #2521: unbounded e.text() on HTTP error path (with PoC) https://github.com/ag-ui-protocol/ag-ui/issues/2521

## From the sources

A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_