ag-ui TypeScript SDK EUVD-2026-114879

Exploitation requires the attacker to act as (or control) the interrupt/event producer feeding an ag-ui TypeScript client thread - i.e. emitting a run outcome of type 'interrupt' - and to supply one or more Interrupt objects that omit the expiresAt field. Per the source evidence, isInterruptExpired treats a missing expiresAt as 'never expires,' and the client's resume-coverage check requires every pending interrupt to be addressed before the thread may run again, so the thread is blocked permanently; prior to the fix there was also no cap on how many pending interrupts were tracked per thread. Limiting factors: this is availability-only (no data exposure or modification), affects the ag-ui client SDK at versions up to 0.0.58, and the attacker must occupy the low-privilege producer position (PR:L), not an arbitrary unauthenticated outsider; impact is confined to wedged threads and growth of tracked interrupts rather than full service crash.

This is a medium-severity, availability-only denial-of-service issue (CWE-400) in the ag-ui TypeScript client SDK, and the signals consistently point to a real-but-not-urgent problem rather than a high-impact emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P, score 5.3) indicates a network-reachable, low-complexity flaw requiring low privileges (PR:L = authenticated/positioned producer) with only partial availability impact and no confidentiality or integrity effect. The 'E:P' (Proof-of-Concept) exploit-maturity flag aligns with the intelligence that a PoC reference exists but is not verified as working exploit code. There is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the vuln.today Decision label is 'this_month', not act_now or emergency. The source-code evidence (PR #3241) corroborates the mechanism precisely: isInterruptExpired treats a missing expiresAt as 'never expires,' and the resume-coverage check blocks a thread until every pending interrupt is retired, so interrupts that omit expiresAt wedge the thread permanently, and pending interrupts were tracked without a per-thread cap. One conflict to verify: the intelligence states 'Patch: Available from vendor,' but the CVE description and the reference both indicate the fix (PR #3241) still awaits acceptance/merge - treat the fix as proposed, not confirmed released. Net: a legitimate availability hardening fix for exposed ag-ui deployments, prioritized for this-month remediation rather than immediate response.

An attacker who is positioned as the event producer for an ag-ui client thread (for example a malicious or compromised agent/server emitting RUN_FINISHED outcomes) sends one or more interrupt objects that omit the expiresAt field. Because isInterruptExpired treats a missing expiry as never-expiring and the resume-coverage check requires every pending interrupt to be retired first, the victim's thread is wedged indefinitely and pending interrupts accumulate unbounded, consuming resources. A public PoC reference exists (GitHub issue #2525); it is not verified as working exploit code.