Packages / @ai-sdk/provider-utils / Security

LowVulnerabilityGHSA-866g-f22w-33x8CVE-2026-8769Published 18 May 2026

@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

Affected releases · @ai-sdk/provider-utils

  • 5.x5.0.0Fixed in 5.0.1
  • 4.x4.0.0 – 4.0.32Fixed in 4.0.33
  • 3.x3.0.0 – 3.0.27Fixed in 3.0.28
  • 2.x and older0.0.0 – 2.2.8No fix, no longer updated

On 5.x, the newest line:

npm install @ai-sdk/provider-utils@5.0.1
5.x

  1. Affected

    5.0.0

    1 release

  2. Fixed

    5.0.1 – 5.0.65

    62 releases, latest

4.x

  1. Affected

    4.0.0 – 4.0.32

    33 releases

  2. Fixed

    4.0.33 – 4.0.62

    30 releases

3.x

  1. Affected

    3.0.0 – 3.0.27

    28 releases

  2. Fixed

    3.0.28 – 3.0.42

    14 releases

2.x

  1. Affected

    2.0.0 – 2.2.8

    34 releases

1.x

  1. Affected

    1.0.0 – 1.0.22

    22 releases

0.x

  1. Affected

    0.0.0 – 0.0.16

    17 releases

241 stable releases of @ai-sdk/provider-utils, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @ai-sdk/provider-utils. It is read in your browser and sent nowhere.

What happens

Versions of @ai-sdk/provider-utils before 3.0.28, from 4.0.0 before 4.0.33, and from 5.0.0 before 5.0.1 are vulnerable to uncontrolled resource consumption. The createJsonResponseHandler, createJsonErrorResponseHandler, and createStatusCodeErrorResponseHandler functions in packages/provider-utils/src/response-handler.ts read response bodies without a shared size limit, allowing a remote attacker with low privileges to cause excessive memory consumption. The exploit has been publicly disclosed and may be utilized.