CVE-2026-118128 in a2a-js
Summary
by MITRE • 10/28/2026
A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The a2a-js library, specifically versions up through 1.1.0, contains a critical race condition vulnerability within its Task Status Update Handler component. This flaw resides in the ResultManager.applyStatusUpdate function located in the src/server/result_manager.ts file. The vulnerability arises from improper synchronization mechanisms when handling concurrent status updates for tasks managed by the server-side logic of the application. In asynchronous JavaScript environments like Node.js, which a2a-js operates within, race conditions often occur when multiple threads or event loop callbacks attempt to read and modify shared state without adequate locking or atomic operations. In this specific case, the applyStatusUpdate function fails to properly serialize access to task status data structures, allowing concurrent requests to overwrite each other's updates or process stale data. This lack of synchronization creates a window where an attacker can manipulate the timing of incoming requests to exploit the inconsistent state of the task object.
The operational impact of this race condition is significant because it undermines the integrity and reliability of task management within applications utilizing a2a-js. Since the vulnerability allows for remote exploitation, attackers who have network access to the service hosting the affected component can craft maliciously timed HTTP requests or WebSocket messages designed to trigger concurrent status updates. By carefully timing these requests, an attacker may be able to cause data corruption, such as losing critical update information, forcing a task into an incorrect state, or potentially bypassing intended security checks that rely on accurate status tracking. This could lead to unauthorized access if the application logic assumes certain tasks are complete when they are not, or it could result in denial of service by causing internal errors due to invalid state transitions. The ability to manipulate these updates remotely makes this a high-severity issue for any production environment relying on precise task orchestration and status reporting.
From a security classification perspective, this vulnerability aligns with CWE-362, which describes concurrent execution using shared resources with improper synchronization. It also relates to the concept of Time-of-check to time-of-use (TOCTOU) vulnerabilities where the state checked at one moment is not guaranteed to be valid when used later due to intervening changes caused by race conditions. In terms of MITRE ATT&CK, this behavior can facilitate lateral movement or privilege escalation if the task status controls access permissions or workflow progression within a larger system architecture. The remote nature of the attack vector means that no local access or authentication is necessarily required to initiate the exploitation attempt, although successful exploitation may depend on specific application logic and network conditions.
To mitigate this vulnerability, it is strongly recommended to upgrade the a2a-js dependency to version 1.2.0 or later immediately. The patch identified by commit hash 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25 addresses this issue by implementing proper synchronization mechanisms within the ResultManager.applyStatusUpdate function. This likely involves introducing mutex locks, atomic operations, or other concurrency control patterns to ensure that status updates are processed sequentially and consistently. Organizations should verify their package management systems to confirm the upgrade has been applied across all affected environments. Additionally, until the patch is fully deployed in production, implementing rate limiting on task update endpoints may help reduce the likelihood of successful race condition exploitation by slowing down concurrent request volumes. Monitoring logs for unusual patterns of rapid status changes can also serve as a temporary detection mechanism for potential active exploitation attempts.