ag-ui CVE-2026-120234

The flaw is in the ag-ui TypeScript client's HTTP Transport error path (runHttpRequest / the e.text error-body read), which, per the PR diff, previously read a non-success HTTP response body in full with no size limit. Exploitation requires that the client connect to a server the attacker controls, has compromised, or can MITM, and that this server return a non-success status with an oversized or unbounded response body, which the client then buffers entirely. Limiting factors: the impact is confined to availability (memory/resource consumption) of a single client process, with no data disclosure or modification; the victim must initiate a request to an attacker-influenced endpoint, so a purely passive target is not affected. Affected versions are ag-ui up to 0.0.58.

This is a medium-severity, availability-only issue, not a top-priority emergency. The CVSS 4.0 vector (5.3) shows network reach and low complexity but only limited availability impact (VA:L) with no confidentiality or integrity effect (VC:N/VI:N), consistent with the CWE-400 resource-consumption nature of the flaw. The PR diff confirms the mechanism: the TypeScript client's HTTP error path read an entire non-success response body into memory with no size bound, so a malicious or compromised server can return an oversized body and exhaust client memory. Exploit maturity is Proof-of-Concept (E:P) and the input states the PoC is a reference only, not verified working exploit code, so this is below confirmed active exploitation. No EPSS score was provided and the vulnerability is not in CISA KEV, so there is no signal of widespread or confirmed in-the-wild use. The input CVSS 4.0 vector sets PR:L, but this is a client-side flaw triggered by a server response - no privileges on the victim client are actually required - so PR:N is more defensible; verify the intended threat model with the vendor. The vuln.today decision label is 'this_month', aligning with a plan-and-patch cadence rather than immediate action.

An ag-ui TypeScript client issues an HTTP request to an agent backend the attacker controls or has compromised (or can MITM on an unprotected channel). The server responds with a non-success status and a very large or effectively unbounded error body; the client buffers the whole body in memory via the error-path text read, consuming resources and potentially exhausting memory. A public PoC reference exists (GitHub issue #2521) but is not verified as working exploit code; the low attack complexity means a single oversized chunk is enough to trigger the condition.