npm/@ai-sdk/provider-utils CVE-2026-8769: medium 4.3, EPSS 0.56%
@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue
Action: Upgrade @ai-sdk/provider-utils to 3.0.28 or later.
npm i @ai-sdk/provider-utils@3.0.28npm i @ai-sdk/provider-utils@4.0.33npm i @ai-sdk/provider-utils@5.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.0.28 | - |
| 4.0.0-beta.10 | 4.0.33 | - |
| 5.0.0-beta.0 | 5.0.1 | - |
Fixed versions
| 3.0.28 | 4.0.33 | 5.0.1 |
Sources
- osv: GHSA-866g-f22w-33x8
- https://nvd.nist.gov/vuln/detail/CVE-2026-8769
- https://github.com/vercel/ai/pull/16374
- https://github.com/vercel/ai/commit/6a436e31d247d678ddaedfc6f61e73ac0595e4b4
- https://github.com/vercel/ai/commit/b30e43ac3fae2432a40b4f4f27f844f3d78b119e
- https://github.com/vercel/ai/commit/b85c4fbc603b8173cf50a9790823397aada908a9
- https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb
- https://github.com/vercel/ai
- https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md#501
- https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@3.0.28
- https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@4.0.33
- https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@5.0.1
- https://vuldb.com/submit/811406
- https://vuldb.com/vuln/364394
- https://vuldb.com/vuln/364394/cti
CVE-2026-8769 · published · modified · JSON