Is CVE-2026-118128 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118128 being exploited in the wild.

How severe is CVE-2026-118128?

Medium severity, with a CVSS score of 6.5, published 27 October 2026.

Is there a fix for CVE-2026-118128?

Yes: fixed in 1.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118128 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118128?

Check whether you run A2aproject A2a-Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118128: a2aproject a2a-js race condition in task status update

CVE-2026-118128 · Severity: medium · CVSS 6.5 · Published 2026-10-27

a2a-js is a JavaScript SDK that manages distributed task execution and status coordination. A race condition in the task status handler can allow concurrent updates to overwrite terminal task states (completed, failed, canceled) with incorrect statuses, causing tasks to appear incomplete or be re-executed incorrectly. This could lead to data loss, task corruption, or inconsistent system behavior in applications relying on accurate task completion tracking.

Vendors: A2aproject.

Quick answers

Is CVE-2026-118128 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118128 being exploited in the wild.
How severe is CVE-2026-118128?: Medium severity, with a CVSS score of 6.5, published 27 October 2026.
Which products and versions are affected?: A2aproject A2a-Js up to 1.1.0.
Is there a fix for CVE-2026-118128?: Yes: fixed in 1.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118128 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118128?: Check whether you run A2aproject A2a-Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.2.0

Technical details

A race condition exists in ResultManager.applyStatusUpdate (src/server/result_manager.ts) where terminal task states can be overwritten by late-arriving status updates, and cancelTask lacks atomic check-then-act semantics. An attacker or concurrent process can exploit the TOCTOU (time-of-check-time-of-use) gap between loading a task's state and persisting an update to corrupt task status, allowing a completed task to be marked canceled or vice versa. The fix guards terminal state transitions and routes cancelTask through the locking mechanism to ensure atomicity.

Affected products

a2aproject a2a-js up to 1.1.0

Timeline

2026-10-27: disclosed
2026-08-26: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.