AIKIDO-2026-62489
@ag-ui/client is vulnerable to Denial of Service (DoS)
43
Medium Risk
This Affects:
@ag-ui/clientTL;DR
During legacy event conversion, JSON.parse processes a tool call's function.arguments without error handling. Arguments from model output that are malformed or not JSON throw an uncaught exception, stopping conversion and its event stream. Any model or tool output that reaches the legacy conversion path can trigger the failure. With the fix, parse errors are caught and reported as stream errors.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the legacy event conversion path with tool call arguments from model output.
Background info
@ag-ui/client is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 0.0.59.
How to fix this
Upgrade the @ag-ui/client library to the patch version.
Links
Related Issue
Other
github.com/ag-ui-protocol/ag-ui/blob/%40ag-ui%2Fclient%401.0.0/sdks/typescript/packages/client/CHANGELOG.md#100--2026-09-17github.com/ag-ui-protocol/ag-ui/
vuldb.com/cve/CVE-2026-101101vuldb.com/submit/934981vuldb.com/vuln/410976vuldb.com/vuln/410976/cti
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.