CVE-2026-118128

Received Received - Intake

Race Condition in a2a-js Task Status Update Handler

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulDB

Description

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-27

Last Modified

2026-10-27

Generated

2026-10-28

AI Q&A

2026-10-28

EPSS Evaluated

N/A

NVD

CVE-2026-118128

EUVD

EUVD-2026-111404

Affected Vendors & Products

Vendor	Product	Version / Range
a2aproject	a2a-js	1.0
a2aproject	a2a-js	1.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in the a2a-js library up to version 1.1.0, specifically in the ResultManager.applyStatusUpdate function. It allows remote attackers to manipulate task status updates due to improper handling in the server-side component.

Detection Guidance

This vulnerability is specific to a2a-js versions up to 1.1.0 and involves a race condition in the ResultManager.applyStatusUpdate function. To detect it, check the installed version of a2a-js using npm list a2a-js or by inspecting package.json. If the version is 1.1.0 or lower, the system is vulnerable.

Impact Analysis

The race condition may lead to unauthorized or inconsistent task status updates, potentially causing data corruption or unexpected behavior in applications using the affected library. Remote exploitation is possible without authentication.

Compliance Impact

This vulnerability involves a race condition in the Task Status Update Handler of a2a-js, which could lead to unauthorized data modifications or inconsistencies. Such issues may impact compliance with GDPR by potentially violating data integrity and security principles, and with HIPAA by risking unauthorized access or alterations to protected health information.

Mitigation Strategies

Upgrade the affected component a2a-js to version 1.2.0 or later to address the race condition vulnerability in the Task Status Update Handler.

Hi! I’m here to help you understand CVE-2026-118128. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70