{"id":"CVE-2026-120235","kind":"vulnerability","aliases":["CVE-2026-120235"],"related":[],"title":"AG-UI protocol SSE parser lets remote input exhaust client resources","description":"A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected is the function parseSSEStream of the file sdks/typescript/packages/client/src/transform/sse.ts of the component SSE Parser. The manipulation leads to resource consumption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 9e7b2b00bce215bbf731f1e6094f63812527c432. The affected component should be upgraded.","summary":"The AG-UI protocol TypeScript client parses server-sent event streams in a way that a crafted stream can make consume excessive resources. An attacker who can send such a stream to the client can degrade or stall the application using it.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ag-ui","ai-agents","ai-tooling","sse","typescript"],"not_affected_if":["not-using-ag-ui-client"],"how_to_check":"- Look for the `ag-ui-protocol` or `@ag-ui/client` package in `package.json` and lockfiles, and check the installed version.\n- Confirm whether the affected `parseSSEStream` code path in `sdks/typescript/packages/client/src/transform/sse.ts` is in use.","fix":"- ag-ui up to `0.0.58`: upgrade to a later release; the sources name patch commit `9e7b2b00bce215bbf731f1e6094f63812527c432` but do not state the fixed version number.","status":"open","published_at":"2026-11-01T16:18:14+00:00","first_seen_at":"2026-11-01T16:20:45+00:00","triaged_at":"2026-11-01T16:22:46+00:00","updated_at":"2026-11-01T16:22:46+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-01T16:22:46Z","model":"claude-haiku-5-5","output":{"fix":"- ag-ui up to `0.0.58`: upgrade to a later release; the sources name patch commit `9e7b2b00bce215bbf731f1e6094f63812527c432` but do not state the fixed version number.","reach":"network","title":"AG-UI protocol SSE parser lets remote input exhaust client resources","impact":"low","summary":"The AG-UI protocol TypeScript client parses server-sent event streams in a way that a crafted stream can make consume excessive resources. An attacker who can send such a stream to the client can degrade or stall the application using it.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["ag-ui","typescript","ai-agents","sse"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Client application becomes slow or unresponsive under crafted stream","analyst_note":"Confirm the fixed version number and the trigger conditions from the advisory or the patch commit 9e7b2b00bce215bbf731f1e6094f63812527c432.","how_to_check":"- Look for the `ag-ui-protocol` or `@ag-ui/client` package in `package.json` and lockfiles, and check the installed version.\n- Confirm whether the affected `parseSSEStream` code path in `sdks/typescript/packages/client/src/transform/sse.ts` is in use.","plain_action":"","needs_analyst":true,"not_affected_if":["not-using-ag-ui-client"],"who_is_affected":"Applications that use the AG-UI TypeScript client to read SSE streams from an agent backend are exposed, because the flaw is in the client-side stream parser that handles remote data. Systems that do not use the AG-UI client, or that only run it against trusted servers, can skip it. The sources do not say what input size or stream shape triggers the exhaustion.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000757,"input_tokens":4197,"output_tokens":674,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120235':15A,18A '-2026':14A,17A '0.0.58':89C '9e7':132C 'affect':90C,135C 'ag':2A,20B,32B,81C,85C 'ag-ui':1A,19B,31B,84C 'ag-ui-protocol':80C 'agent':24B 'ai':23B,26B 'ai-ag':22B 'ai-tool':25B 'applic':71B 'attack':56B,111C 'b2b00bce215bbf731f1e6094f63812527c432':133C 'client':11A,36B,65B 'compon':101C,136C 'consum':52B 'consumpt':109C 'craft':48B 'cve':13A,16A 'degrad':67B 'detect':78C 'disclos':120C 'event':41B 'excess':53B 'exhaust':10A 'exploit':117C 'file':97C 'function':93C 'identifi':127C 'initi':114C 'input':9A 'lead':106C 'let':7A 'make':51B 'manipul':105C 'may':112C,123C 'pars':37B 'parser':6A,103C 'parsessestream':94C 'patch':130C 'protocol':4A,34B,83C 'public':121C 'remot':8A,115C 'resourc':12A,54B,108C 'sdks/typescript/packages/client/src/transform/sse.ts':98C 'secur':74C 'send':59B 'sent':40B 'server':39B 'server-s':38B 'sse':5A,28B,102C 'stall':69B 'stream':42B,49B,62B 'tool':27B 'typescript':29B,35B 'ui':3A,21B,33B,82C,86C 'upgrad':139C 'use':72B,125C 'vulner':75C 'way':45B","nicknames":[],"mitigations":[],"who_affected":"Applications that use the AG-UI TypeScript client to read SSE streams from an agent backend are exposed, because the flaw is in the client-side stream parser that handles remote data. Systems that do not use the AG-UI client, or that only run it against trusted servers, can skip it. The sources do not say what input size or stream shape triggers the exhaustion.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T16:18:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120235","severity":null,"published_at":"2026-11-01T16:18:14+00:00","modified_at":"2026-11-01T16:18:14+00:00","first_seen_at":"2026-11-01T16:20:45+00:00","fetched_at":"2026-11-01T16:20:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}