Five AG-UI client flaws leave three fixes pending

What the five CVEs cover

CVE-2026-120233 [1] covers HttpAgent following redirects. A public proof of concept shows a run request and developer-supplied headers reaching another origin.[1][10]

CVE-2026-120234 [2] covers an HTTP transport path that reads an error response without a size limit.[2]

CVE-2026-120235 [3] covers unbounded SSE buffering, while CVE-2026-120236 [4] covers missing validation in a transport decoder.[3][4]

CVE-2026-120237 [5] covers an interrupt with no expiresAt value being treated as permanent, which can block later runs.[5]

Which flaws are fixed

The AG-UI 1.0.0 release notes [6] record fixes corresponding to the SSE buffer and protobuf validation issues.[3][4][6]

The upgrade does not fix CVE-2026-120233, CVE-2026-120234 or CVE-2026-120237. Their pull requests were open and unmerged on November 2.[7][8][9]

Test event decoding, state recovery, tool calls and stream cancellation because the 1.0 line also contains protocol changes.

Response checklist for AG-UI teams

• Search lockfiles, manifests, browser bundles and software bills of materials for @ag-ui/client, including transitive copies.
• Upgrade affected 0.0.x installations to the current compatible 1.x release and verify the final production bundle.
• Allowlist agent endpoint origins and reject redirects at a trusted proxy or wrapper.
• Set error-body, stream-buffer and request-time limits outside the client.
• Keep agent endpoints away from cloud metadata and internal administration networks.
• Clear stalled interrupts at a trusted layer and alert when a thread cannot start a later run.
• Review logs for redirect targets, oversized errors, prolonged streams and blocked runs. Rotate credentials if an unauthorized origin received them.
• Track pull requests 2575, 2698 and 3241, then verify the merged code and published package.

How to test the upgrade and controls

• Replay normal SSE and protobuf fixtures and compare events, state and tool calls.
• Return 301, 302, 307 and 308 responses and confirm that no private header or body reaches the target.
• Send bounded oversized errors and unterminated SSE data in a disposable environment, then check memory limits.
• Send an interrupt without expiresAt, finish the run and confirm that the same thread can start another run.
• Repeat the cases in each supported browser and server runtime.

What remains uncertain

• NVD had not completed its own enrichment when Learnetto checked the records on November 2.[1][2][3][4][5]
• The public records do not establish active exploitation against deployed AG-UI applications.
• Three proposed fixes remained unmerged, so their final code and release versions may change.[7][8][9]
• Impact depends on endpoint trust, headers, conversation contents, network reachability, process limits and recovery logic.

Frequently asked questions

• Is upgrading to 1.0.0 or later enough? It fixes two listed CVEs. Keep controls for the three pending fixes.
• Does this affect every AG-UI implementation? The records point to TypeScript @ag-ui/client paths.
• Does CopilotKit use AG-UI? CopilotKit documents AG-UI as its event interface, but teams must inspect their dependency trees.
• Are the flaws in CISA KEV? None appeared in the catalog when checked on November 2.[11]
• When can temporary controls be removed? Wait for released fixes and pass the regression cases.