Threats affecting pkg:npm/ag-ui-protocol/ag-ui

CVE-2026-120237 is a medium severity vulnerability in the ag-ui component of ag-ui-protocol up to version 0.0.58. The flaw exists in the isInterruptExpired function within the Interrupt expiry component, causing resource consumption. Remote exploitation is possible, and public exploit code has been published. A fix has been proposed via a pull request but is not yet accepted or released.