GHSA-866g-f22w-33x8LowCVSS 4.3

@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

Published
May 18, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (1)

📋 Description

Versions of @ai-sdk/provider-utils before 3.0.28, from 4.0.0 before 4.0.33, and from 5.0.0 before 5.0.1 are vulnerable to uncontrolled resource consumption. The createJsonResponseHandler, createJsonErrorResponseHandler, and createStatusCodeErrorResponseHandler functions in packages/provider-utils/src/response-handler.ts read response bodies without a shared size limit, allowing a remote attacker with low privileges to cause excessive memory consumption. The exploit has been publicly disclosed and may be utilized.

🎯 Affected products3

  • npm/@ai-sdk/provider-utils:< 3.0.28
  • npm/@ai-sdk/provider-utils:>= 4.0.0-beta.10, < 4.0.33
  • npm/@ai-sdk/provider-utils:>= 5.0.0-beta.0, < 5.0.1

🔗 References (14)