{"data":{"id":"0d4fa4ea-d411-43e2-8dc4-0aa3571549d7","title":"GHSA-866g-f22w-33x8: @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue","summary":"Versions of `@ai-sdk/provider-utils` before 3.0.28, from 4.0.0 before 4.0.33, and from 5.0.0 before 5.0.1 are vulnerable to uncontrolled resource consumption. The functions `createJsonResponseHandler`, `createJsonErrorResponseHandler`, and `createStatusCodeErrorResponseHandler` in `packages/provider-utils/src/response-handler.ts` read response bodies without a shared size limit, so a remote attacker with low privileges can cause excessive memory consumption. A public exploit has been disclosed.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-866g-f22w-33x8","publishedAt":"2026-05-18T00:31:37.000Z","cveId":"CVE-2026-8769","cweIds":["CWE-400"],"cvssScore":"4.3","cvssSeverity":"low","severity":"low","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["@ai-sdk/provider-utils@< 3.0.28 (fixed: 3.0.28)","@ai-sdk/provider-utils@>= 4.0.0-beta.10, < 4.0.33 (fixed: 4.0.33)","@ai-sdk/provider-utils@>= 5.0.0-beta.0, < 5.0.1 (fixed: 5.0.1)"],"affectedPackageNames":["@ai-sdk/provider-utils"],"affectedPackageRefs":["npm:@ai-sdk/provider-utils"],"affectedVendors":[],"affectedVendorsRaw":["@ai-sdk/provider-utils"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00728,"epssCheckedAt":"2026-10-10T04:57:27.022Z","kevDateAdded":null,"advisoryAliases":["GHSA-866g-f22w-33x8"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-18T00:31:37.000Z","capecIds":["CAPEC-125","CAPEC-130"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}