CVE-2026-40608: Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15…
CVE-2026-40608 · Severity: medium · CVSS 6.2 · Published 2026-04-21
Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers (/api/state, /api/restore, and /api/history-svg) that process incoming requests by accumulating the entire request body into a JavaScript string without any size limitations. Node.js buffers the entire payload in the V8 heap. Sending a sufficiently large body (e.g., 500 MiB or more) will exhaust the process heap memory, leading to an Out-of-Memory (OOM) error that crashes the MCP server. This vulnerability is fixed in 0.4.15.
No. Junglewise Threat Intelligence has no report of CVE-2026-40608 being exploited in the wild.
How severe is CVE-2026-40608?
Medium severity, with a CVSS score of 6.2, published 21 April 2026.
Which products and versions are affected?
DayuanJiang Next-Ai-Draw-Io. The advisory does not name versions.
Is there a fix for CVE-2026-40608?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-40608?
Check whether you run DayuanJiang Next-Ai-Draw-Io. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.