CVE-2026-120234

AG-UI HTTP error responses can exhaust client memory

AG-UI Protocol · @ag-ui/client HTTP transport

First documented disclosure · Review checkpoint

Summary

A malicious agent endpoint can force the client to retain an unbounded error response.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Controlled researcher evidence; the reviewed primary sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The non-success HTTP path reads the entire response with text() and retains it in the Error message and payload, unlike the streamed success path.

Conditions required

The client connects to an attacker-controlled or compromised endpoint that returns a large non-2xx response. Runtime memory and application logging determine the practical effect.

Potential impact

Memory exhaustion and client availability loss; attacker-controlled response text may also reach logs or UI. The demonstrated 50 MB response caused about 46.6 MB heap growth, not a documented victim outage.

Affected versions and configurations

CNA lists through 0.0.58; researcher tested 0.0.58. Read-only inspection also finds the unbounded response.text() path in published 1.0.3.

Fix and mitigation status

No fixed release verified. Proposed PR #2698 remains open and unmerged on November 2.

Practical next steps

Apply an independently reviewed bounded error-body reader or await the maintainer fix. Limit response sizes and timeouts at the transport boundary and log bounded excerpts.

Operating lesson

Error responses need the same resource limits as successful streams.

Evidence and limits

Public issue August 25; proposed fix September 9; CNA November 1. CNA Medium 5.3 CVSS 4.0 (4.3 v3.1). The proposed 64 KiB preview limit does not bound an already allocated incoming chunk. Later-version observations come from integrity-verified npm package source, without executing package code.

Sources