# CVE-2026-40608: Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15…

Source: https://junglewise.ai/threats/cve-2026-40608-next-ai-draw-io-is-a-next-js-web-application-that-integrates-ai  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-21  
License: CC BY 4.0 with a link back

CVE-2026-40608 · Severity: medium · CVSS 6.2 · Published 2026-04-21

Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers (/api/state, /api/restore, and /api/history-svg) that process incoming requests by accumulating the entire request body into a JavaScript string without any size limitations. Node.js buffers the entire payload in the V8 heap. Sending a sufficiently large body (e.g., 500 MiB or more) will exhaust the process heap memory, leading to an Out-of-Memory (OOM) error that crashes the MCP server. This vulnerability is fixed in 0.4.15.

Technologies: [DayuanJiang Next-Ai-Draw-Io](https://junglewise.ai/threats/technologies/next-ai-draw-io). Vendors: [DayuanJiang](https://junglewise.ai/threats/vendors/dayuanjiang).

## Quick answers

**Is CVE-2026-40608 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40608 being exploited in the wild.

**How severe is CVE-2026-40608?** Medium severity, with a CVSS score of 6.2, published 21 April 2026.

**Which products and versions are affected?** DayuanJiang Next-Ai-Draw-Io. The advisory does not name versions.

**Is there a fix for CVE-2026-40608?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-40608?** Check whether you run DayuanJiang Next-Ai-Draw-Io. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- DayuanJiang Next-Ai-Draw-Io

## Related threats

- [DayuanJiang next-ai-draw-io reflected XSS in MCP server mcp parameter](https://junglewise.ai/threats/cve-2026-50758-dayuanjiang-next-ai-draw-io-reflected-xss-in-mcp-server-mcp)
- [DayuanJiang next-ai-draw-io directory traversal in export_diagram tool](https://junglewise.ai/threats/cve-2026-50757-dayuanjiang-next-ai-draw-io-directory-traversal-in-export-diagram)
- [DayuanJiang next-ai-draw-io SSRF guard bypass in x-ai-provider](https://junglewise.ai/threats/cve-2026-50756-dayuanjiang-next-ai-draw-io-ssrf-guard-bypass-in-x-ai-provider)
- [DayuanJiang next-ai-draw-io auth bypass via X-Forwarded-For spoofing](https://junglewise.ai/threats/cve-2026-50755-dayuanjiang-next-ai-draw-io-auth-bypass-via-x-forwarded-for)