# Five AG-UI client flaws leave three fixes pending

Five CVEs published on November 1 affect the TypeScript AG-UI client through version 0.0.58. Version 1.0.0 fixes two, while three proposed fixes remained open on November 2.[1][2][3][4][5]

Five public CVE records cover redirect handling, unbounded error responses, unbounded SSE buffering, protobuf validation and interrupt expiry in @ag-ui/client.[1][2][3][4][5]

Teams should upgrade to the current 1.x release because version 1.0.0 contains fixes for the SSE and protobuf flaws.[3][4][6] That upgrade does not close the redirect, HTTP error-body or interrupt-expiry issues. Their proposed patches were still open and unmerged when Learnetto checked them on November 2.[7][8][9]

No cited record establishes active exploitation. Teams should verify the package version and the trust boundary between each application and its agent endpoints.

## What the five CVEs cover

[CVE-2026-120233 [1]](https://nvd.nist.gov/vuln/detail/CVE-2026-120233) covers HttpAgent following redirects. A public proof of concept shows a run request and developer-supplied headers reaching another origin.[1][10]

[CVE-2026-120234 [2]](https://nvd.nist.gov/vuln/detail/CVE-2026-120234) covers an HTTP transport path that reads an error response without a size limit.[2]

[CVE-2026-120235 [3]](https://nvd.nist.gov/vuln/detail/CVE-2026-120235) covers unbounded SSE buffering, while [CVE-2026-120236 [4]](https://nvd.nist.gov/vuln/detail/CVE-2026-120236) covers missing validation in a transport decoder.[3][4]

[CVE-2026-120237 [5]](https://nvd.nist.gov/vuln/detail/CVE-2026-120237) covers an interrupt with no expiresAt value being treated as permanent, which can block later runs.[5]

## Which flaws are fixed

[The AG-UI 1.0.0 release notes [6]](https://github.com/ag-ui-protocol/ag-ui/releases/tag/release%2F2026-09-17) record fixes corresponding to the SSE buffer and protobuf validation issues.[3][4][6]

The upgrade does not fix CVE-2026-120233, CVE-2026-120234 or CVE-2026-120237. Their pull requests were open and unmerged on November 2.[7][8][9]

Test event decoding, state recovery, tool calls and stream cancellation because the 1.0 line also contains protocol changes.

## Response checklist for AG-UI teams

- Search lockfiles, manifests, browser bundles and software bills of materials for @ag-ui/client, including transitive copies.
- Upgrade affected 0.0.x installations to the current compatible 1.x release and verify the final production bundle.
- Allowlist agent endpoint origins and reject redirects at a trusted proxy or wrapper.
- Set error-body, stream-buffer and request-time limits outside the client.
- Keep agent endpoints away from cloud metadata and internal administration networks.
- Clear stalled interrupts at a trusted layer and alert when a thread cannot start a later run.
- Review logs for redirect targets, oversized errors, prolonged streams and blocked runs. Rotate credentials if an unauthorized origin received them.
- Track pull requests 2575, 2698 and 3241, then verify the merged code and published package.

## How to test the upgrade and controls

- Replay normal SSE and protobuf fixtures and compare events, state and tool calls.
- Return 301, 302, 307 and 308 responses and confirm that no private header or body reaches the target.
- Send bounded oversized errors and unterminated SSE data in a disposable environment, then check memory limits.
- Send an interrupt without expiresAt, finish the run and confirm that the same thread can start another run.
- Repeat the cases in each supported browser and server runtime.

## What remains uncertain

- NVD had not completed its own enrichment when Learnetto checked the records on November 2.[1][2][3][4][5]
- The public records do not establish active exploitation against deployed AG-UI applications.
- Three proposed fixes remained unmerged, so their final code and release versions may change.[7][8][9]
- Impact depends on endpoint trust, headers, conversation contents, network reachability, process limits and recovery logic.

## Frequently asked questions

- Is upgrading to 1.0.0 or later enough? It fixes two listed CVEs. Keep controls for the three pending fixes.
- Does this affect every AG-UI implementation? The records point to TypeScript @ag-ui/client paths.
- Does CopilotKit use AG-UI? CopilotKit documents AG-UI as its event interface, but teams must inspect their dependency trees.
- Are the flaws in CISA KEV? None appeared in the catalog when checked on November 2.[11]
- When can temporary controls be removed? Wait for released fixes and pass the regression cases.

## Sources

- [[1] NVD: CVE-2026-120233](https://nvd.nist.gov/vuln/detail/CVE-2026-120233)
- [[2] NVD: CVE-2026-120234](https://nvd.nist.gov/vuln/detail/CVE-2026-120234)
- [[3] NVD: CVE-2026-120235](https://nvd.nist.gov/vuln/detail/CVE-2026-120235)
- [[4] NVD: CVE-2026-120236](https://nvd.nist.gov/vuln/detail/CVE-2026-120236)
- [[5] NVD: CVE-2026-120237](https://nvd.nist.gov/vuln/detail/CVE-2026-120237)
- [[6] AG-UI 1.0.0 release notes](https://github.com/ag-ui-protocol/ag-ui/releases/tag/release%2F2026-09-17)
- [[7] Pull request 2575](https://github.com/ag-ui-protocol/ag-ui/pull/2575)
- [[8] Pull request 2698](https://github.com/ag-ui-protocol/ag-ui/pull/2698)
- [[9] Pull request 3241](https://github.com/ag-ui-protocol/ag-ui/pull/3241)
- [[10] Redirect proof of concept](https://github.com/ag-ui-protocol/ag-ui/issues/2520)
- [[11] CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)