Executive brief
Vercel AI SDK is a library used by developers to integrate various AI models into their applications. A vulnerability in its response handling component allows a malicious AI provider or a compromised server to send an infinite stream of data, causing the application to run out of memory and crash. This can lead to a complete service outage (Denial of Service), especially in multi-tenant environments where users can configure their own AI endpoints.
Technical details
The @ai-sdk/provider-utils package lacks response size limits in its `createJsonResponseHandler` and `createJsonErrorResponseHandler` functions within `packages/provider-utils/src/response-handler.ts`. These handlers use `await response.text()` to buffer the entire HTTP response body into memory without constraints. An attacker who can control the API endpoint (baseURL) used by the SDK—common in agent orchestration platforms—can return an infinite chunked response. This causes the Node.js process to exhaust the V8 heap memory, resulting in a fatal 'out of memory' error and process termination. While other parts of the SDK use `readResponseWithSizeLimit()`, this specific pathway remains unprotected.
Affected products
- Vercel AI SDK (provider-utils) <= 3.0.97
Timeline
- 2026-04-04: other: Vulnerability details and PoC shared in a public Gist
- 2026-05-17: disclosed: CVE-2026-8769 published by VulDB
- 2026-05-18: advisory: GitHub Advisory GHSA-866g-f22w-33x8 published