# CVE-2026-118128: a2aproject a2a-js race condition in task status update

Source: https://junglewise.ai/threats/cve-2026-118128-a-vulnerability-has-been-found-in-a2aproject-a2a-js-up-to-1-1-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-118128 · Severity: medium · CVSS 6.5 · Published 2026-10-27

a2a-js is a JavaScript SDK that manages distributed task execution and status coordination. A race condition in the task status handler can allow concurrent updates to overwrite terminal task states (completed, failed, canceled) with incorrect statuses, causing tasks to appear incomplete or be re-executed incorrectly. This could lead to data loss, task corruption, or inconsistent system behavior in applications relying on accurate task completion tracking.

Vendors: [A2aproject](https://junglewise.ai/threats/vendors/a2aproject).

## Quick answers

**Is CVE-2026-118128 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118128 being exploited in the wild.

**How severe is CVE-2026-118128?** Medium severity, with a CVSS score of 6.5, published 27 October 2026.

**Which products and versions are affected?** A2aproject A2a-Js up to 1.1.0.

**Is there a fix for CVE-2026-118128?** Yes: fixed in 1.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118128 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118128?** Check whether you run A2aproject A2a-Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.2.0

## Technical details

A race condition exists in ResultManager.applyStatusUpdate (src/server/result_manager.ts) where terminal task states can be overwritten by late-arriving status updates, and cancelTask lacks atomic check-then-act semantics. An attacker or concurrent process can exploit the TOCTOU (time-of-check-time-of-use) gap between loading a task's state and persisting an update to corrupt task status, allowing a completed task to be marked canceled or vice versa. The fix guards terminal state transitions and routes cancelTask through the locking mechanism to ensure atomicity.

## Affected products

- a2aproject a2a-js up to 1.1.0

## Timeline

- 2026-10-27: disclosed
- 2026-08-26: patched

## References

- [https://github.com/a2aproject/a2a-js/](https://github.com/a2aproject/a2a-js/)
- [https://github.com/a2aproject/a2a-js/commit/7b87c9480bfa643f9d2b2eaf06988b3d3a95de25](https://github.com/a2aproject/a2a-js/commit/7b87c9480bfa643f9d2b2eaf06988b3d3a95de25)