@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

Description

A vulnerability was determined in Vercel AI up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 3.0.97

References

• GHSA-866g-f22w-33x8
• vuldb.com
• CVE-2026-8769
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• @isaacs/brace-expansion has Uncontrolled Resource Consumption - CVE-2026-25547
• DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption - CVE-2026-10691
• @tinacms/graphql has a Path Traversal issue - CVE-2026-24125
• Uncontrolled Resource Consumption in markdown-it - CVE-2022-21670

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@ai-sdk/provider-utils