What happened
Five CVEs (published 1 November 2026 by VulDB, cna@vuldb.com) target the AG-UI protocol TypeScript client. Two are fixed in @ag-ui/client 1.0.0; three (120234 unbounded error-body read, 120236 protobuf schema-validation skip, 120237 interrupt-expiry stall) remain unfixed in the current 1.0.3 release, each with a public PoC in a GitHub issue. The advisories carry no GitHub Security Advisory — they were assigned and published only via VulDB's CNA, so dependency scanners keyed on the repo/org name can miss them.
Why it matters
AG-UI is the protocol by which an AI agent backend streams state, tool calls and generative UI to agent frontends like CopilotKit. Unbounded-memory growth, a schema-validation bypass that corrupts agent-run state, and a message that permanently stalls a thread's runs are agent-orchestration DoS/integrity flaws on a widely reused client. Because the unfixed CVEs are only tracked via VulDB and lack GHSA entries, they are easy for defenders to miss.
Attack vector
Multiple weaknesses in the AG-UI client that an AI agent backend streams state to an agent frontend: the transport reads an entire error response into memory with no size cap (CVE-2026-120234); the SSE parser buffers an unterminated stream tail with no cap (CVE-2026-120235); the protobuf decoder skips the schema validation the SSE path enforces, so a malformed event can corrupt run state (CVE-2026-120236, public PoC); and interrupt expiry treats a missing expiresAt as never-expiring, letting one RUN_FINISHED message stall a thread's runs permanently (CVE-2026-120237).
Affected systems
@ag-ui/client / ag-ui-protocol ag-ui 0.0.1–0.0.58 (npm @ag-ui/client; CVE-2026-120234, 120235, 120236, 120237)
Mitigation
CVE-2026-120235 and CVE-2026-120236 are fixed in @ag-ui/client 1.0.0 (published 2026-09-17). CVE-2026-120233/120234/120237 have only open, unmerged PRs and are NOT present in the current @ag-ui/client 1.0.3 — pin/upgrade is the only path and a full fix is pending upstream.