~ / search / GHSA-866g-f22w-33x8

GHSA-866g-f22w-33x8

@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

Source: GitHub Advisory Database (reviewed) Low CVE-2026-8769

Packages

EcosystemPackageAffectedFixed in
npm @ai-sdk/provider-utils < 3.0.28 3.0.28
npm @ai-sdk/provider-utils >= 4.0.0-beta.10, < 4.0.33 4.0.33
npm @ai-sdk/provider-utils >= 5.0.0-beta.0, < 5.0.1 5.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `@ai-sdk/provider-utils` before 3.0.28, from 4.0.0 before 4.0.33, and from 5.0.0 before 5.0.1 are vulnerable to uncontrolled resource consumption. The `createJsonResponseHandler`, `createJsonErrorResponseHandler`, and `createStatusCodeErrorResponseHandler` functions in `packages/provider-utils/src/response-handler.ts` read response bodies without a shared size limit, allowing a remote attacker with low privileges to cause excessive memory consumption. The exploit has been publicly disclosed and may be utilized.

References

External links from the advisory. They lead to third-party sites.