CVE-2026-101100

A flaw was found in ag-ui's @ag-ui/client npm package. When processing manipulated tool call inputs in FilterToolCallsMiddleware filter-tool-calls.ts, the middleware fails to perform complete resource and state cleanup. A remote authenticated attacker can exploit this vulnerability by submitting...

@a2anet/react (>=0.3.0, <=0.4.0), @ag-kit/adapter-adp (1.0.1-alpha.8) +258 more potentially affected by CVE-2026-101101 via @ag-ui/client (>=0.0.27, <=0.0.59)

@ag-ui/client NPM version =0.0.27, =0.3.0, =0.0.11-alpha.2, =0.0.10-alpha.0, =0.0.10-alpha.0, =0.0.10-alpha.0, =0.0.10-alpha.0, =0.0.10-alpha.1, =0.0.0-alpha-20251017094344, =0.0.0-alpha-20251017094344, =0.0.0-alpha-20251017094344, =0.0.0-alpha-20251017094344, =0.0.10-alpha.1,...

@a2anet/react (>=0.3.0, <=0.4.0), @ag-kit/adapter-adp (1.0.1-alpha.8) +193 more potentially affected by CVE-2026-101100 via @ag-ui/client (>=0.0.42, <=0.0.59)

@ag-ui/client NPM version =0.0.42, =0.3.0, =0.0.11-alpha.3, =0.0.11-alpha.3, =0.0.11-alpha.3, =0.0.11-alpha.3, =0.0.11-alpha.3, =0.0.11-alpha.3, =0.0.11-alpha.3, =0.0.11-alpha.2, =0.0.11-alpha.3, =0.0.11-alpha.3, =0.0.11-alpha.3, =0.0.11-alpha.3, =0.0.11-alpha.3, =1.0.1-alpha.8 and more Source...

CVE-2026-92362: Uncontrolled Resource Consumption

A vulnerability was detected in ag-ui-protocol ag-ui 1.0. This impacts an unknown function of the file crates/ag-ui-client/src/sse.rs of the component SSE Frame Parser. Performing a manipulation results in resource consumption. The attack is possible to be carried out remotely. The pull request t...