GHSA-866g-f22w-33x8
@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue
Quick fix
GHSA-866g-f22w-33x8 — @ai-sdk/provider-utils: upgrade to the fixed version with the command below.
npm install @ai-sdk/provider-utils@3.0.28Details
Versions of `@ai-sdk/provider-utils` before 3.0.28, from 4.0.0 before 4.0.33, and from 5.0.0 before 5.0.1 are vulnerable to uncontrolled resource consumption. The `createJsonResponseHandler`, `createJsonErrorResponseHandler`, and `createStatusCodeErrorResponseHandler` functions in `packages/provider-utils/src/response-handler.ts` read response bodies without a shared size limit, allowing a remote attacker with low privileges to cause excessive memory consumption. The exploit has been publicly disclosed and may be utilized.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 3.0.28npm install @ai-sdk/provider-utils@3.0.284.0.0-beta.10Fixed in: 4.0.33npm install @ai-sdk/provider-utils@4.0.335.0.0-beta.0Fixed in: 5.0.1npm install @ai-sdk/provider-utils@5.0.1References
- https://nvd.nist.gov/vuln/detail/CVE-2026-8769[ADVISORY]
- https://github.com/vercel/ai/pull/16374[WEB]
- https://github.com/vercel/ai/commit/6a436e31d247d678ddaedfc6f61e73ac0595e4b4[WEB]
- https://github.com/vercel/ai/commit/b30e43ac3fae2432a40b4f4f27f844f3d78b119e[WEB]
- https://github.com/vercel/ai/commit/b85c4fbc603b8173cf50a9790823397aada908a9[WEB]
- https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb[WEB]
- https://github.com/vercel/ai[PACKAGE]
- https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md#501[WEB]
- https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@3.0.28[WEB]
- https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@4.0.33[WEB]
- https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@5.0.1[WEB]
- https://vuldb.com/submit/811406[WEB]
- https://vuldb.com/vuln/364394[WEB]
- https://vuldb.com/vuln/364394/cti[WEB]