CVE-2026-8769 - vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption

Back Back to CVE browser

MEDIUM

vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption

Published May 17, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.73%

Description

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Vercel Product AI Default
n/a
- Version
  3.0.0
  Status
  affected
  Constraints
  -
- Version
  3.0.1
  Status
  affected
  Constraints
  -
- Version
  3.0.10
  Status
  affected
  Constraints
  -
- Version
  3.0.11
  Status
  affected
  Constraints
  -
- Version
  3.0.12
  Status
  affected
  Constraints
  -
- Version
  3.0.13
  Status
  affected
  Constraints
  -
- Version
  3.0.14
  Status
  affected
  Constraints
  -
- Version
  3.0.15
  Status
  affected
  Constraints
  -
- Version
  3.0.16
  Status
  affected
  Constraints
  -
- Version
  3.0.17
  Status
  affected
  Constraints
  -
- Version
  3.0.18
  Status
  affected
  Constraints
  -
- Version
  3.0.19
  Status
  affected
  Constraints
  -
- Version
  3.0.2
  Status
  affected
  Constraints
  -
- Version
  3.0.20
  Status
  affected
  Constraints
  -
- Version
  3.0.21
  Status
  affected
  Constraints
  -
- Version
  3.0.22
  Status
  affected
  Constraints
  -
- Version
  3.0.23
  Status
  affected
  Constraints
  -
- Version
  3.0.24
  Status
  affected
  Constraints
  -
- Version
  3.0.25
  Status
  affected
  Constraints
  -
- Version
  3.0.26
  Status
  affected
  Constraints
  -
- Version
  3.0.27
  Status
  affected
  Constraints
  -
- Version
  3.0.28
  Status
  affected
  Constraints
  -
- Version
  3.0.29
  Status
  affected
  Constraints
  -
- Version
  3.0.3
  Status
  affected
  Constraints
  -
- Version
  3.0.30
  Status
  affected
  Constraints
  -
- Version
  3.0.31
  Status
  affected
  Constraints
  -
- Version
  3.0.32
  Status
  affected
  Constraints
  -
- Version
  3.0.33
  Status
  affected
  Constraints
  -
- Version
  3.0.34
  Status
  affected
  Constraints
  -
- Version
  3.0.35
  Status
  affected
  Constraints
  -
- Version
  3.0.36
  Status
  affected
  Constraints
  -
- Version
  3.0.37
  Status
  affected
  Constraints
  -
- Version
  3.0.38
  Status
  affected
  Constraints
  -
- Version
  3.0.39
  Status
  affected
  Constraints
  -
- Version
  3.0.4
  Status
  affected
  Constraints
  -
- Version
  3.0.40
  Status
  affected
  Constraints
  -
- Version
  3.0.41
  Status
  affected
  Constraints
  -
- Version
  3.0.42
  Status
  affected
  Constraints
  -
- Version
  3.0.43
  Status
  affected
  Constraints
  -
- Version
  3.0.44
  Status
  affected
  Constraints
  -
- Version
  3.0.45
  Status
  affected
  Constraints
  -
- Version
  3.0.46
  Status
  affected
  Constraints
  -
- Version
  3.0.47
  Status
  affected
  Constraints
  -
- Version
  3.0.48
  Status
  affected
  Constraints
  -
- Version
  3.0.49
  Status
  affected
  Constraints
  -
- Version
  3.0.5
  Status
  affected
  Constraints
  -
- Version
  3.0.50
  Status
  affected
  Constraints
  -
- Version
  3.0.51
  Status
  affected
  Constraints
  -
- Version
  3.0.52
  Status
  affected
  Constraints
  -
- Version
  3.0.53
  Status
  affected
  Constraints
  -
- Version
  3.0.54
  Status
  affected
  Constraints
  -
- Version
  3.0.55
  Status
  affected
  Constraints
  -
- Version
  3.0.56
  Status
  affected
  Constraints
  -
- Version
  3.0.57
  Status
  affected
  Constraints
  -
- Version
  3.0.58
  Status
  affected
  Constraints
  -
- Version
  3.0.59
  Status
  affected
  Constraints
  -
- Version
  3.0.6
  Status
  affected
  Constraints
  -
- Version
  3.0.60
  Status
  affected
  Constraints
  -
- Version
  3.0.61
  Status
  affected
  Constraints
  -
- Version
  3.0.62
  Status
  affected
  Constraints
  -
- Version
  3.0.63
  Status
  affected
  Constraints
  -
- Version
  3.0.64
  Status
  affected
  Constraints
  -
- Version
  3.0.65
  Status
  affected
  Constraints
  -
- Version
  3.0.66
  Status
  affected
  Constraints
  -
- Version
  3.0.67
  Status
  affected
  Constraints
  -
- Version
  3.0.68
  Status
  affected
  Constraints
  -
- Version
  3.0.69
  Status
  affected
  Constraints
  -
- Version
  3.0.7
  Status
  affected
  Constraints
  -
- Version
  3.0.70
  Status
  affected
  Constraints
  -
- Version
  3.0.71
  Status
  affected
  Constraints
  -
- Version
  3.0.72
  Status
  affected
  Constraints
  -
- Version
  3.0.73
  Status
  affected
  Constraints
  -
- Version
  3.0.74
  Status
  affected
  Constraints
  -
- Version
  3.0.75
  Status
  affected
  Constraints
  -
- Version
  3.0.76
  Status
  affected
  Constraints
  -
- Version
  3.0.77
  Status
  affected
  Constraints
  -
- Version
  3.0.78
  Status
  affected
  Constraints
  -
- Version
  3.0.79
  Status
  affected
  Constraints
  -
- Version
  3.0.8
  Status
  affected
  Constraints
  -
- Version
  3.0.80
  Status
  affected
  Constraints
  -
- Version
  3.0.81
  Status
  affected
  Constraints
  -
- Version
  3.0.82
  Status
  affected
  Constraints
  -
- Version
  3.0.83
  Status
  affected
  Constraints
  -
- Version
  3.0.84
  Status
  affected
  Constraints
  -
- Version
  3.0.85
  Status
  affected
  Constraints
  -
- Version
  3.0.86
  Status
  affected
  Constraints
  -
- Version
  3.0.87
  Status
  affected
  Constraints
  -
- Version
  3.0.88
  Status
  affected
  Constraints
  -
- Version
  3.0.89
  Status
  affected
  Constraints
  -
- Version
  3.0.9
  Status
  affected
  Constraints
  -
- Version
  3.0.90
  Status
  affected
  Constraints
  -
- Version
  3.0.91
  Status
  affected
  Constraints
  -
- Version
  3.0.92
  Status
  affected
  Constraints
  -
- Version
  3.0.93
  Status
  affected
  Constraints
  -
- Version
  3.0.94
  Status
  affected
  Constraints
  -
- Version
  3.0.95
  Status
  affected
  Constraints
  -
- Version
  3.0.96
  Status
  affected
  Constraints
  -
- Version
  3.0.97
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Vercel

n/a

Version	Status	Constraints
3.0.0	affected	-
3.0.1	affected	-
3.0.10	affected	-
3.0.11	affected	-
3.0.12	affected	-
3.0.13	affected	-
3.0.14	affected	-
3.0.15	affected	-
3.0.16	affected	-
3.0.17	affected	-
3.0.18	affected	-
3.0.19	affected	-
3.0.2	affected	-
3.0.20	affected	-
3.0.21	affected	-
3.0.22	affected	-
3.0.23	affected	-
3.0.24	affected	-
3.0.25	affected	-
3.0.26	affected	-
3.0.27	affected	-
3.0.28	affected	-
3.0.29	affected	-
3.0.3	affected	-
3.0.30	affected	-
3.0.31	affected	-
3.0.32	affected	-
3.0.33	affected	-
3.0.34	affected	-
3.0.35	affected	-
3.0.36	affected	-
3.0.37	affected	-
3.0.38	affected	-
3.0.39	affected	-
3.0.4	affected	-
3.0.40	affected	-
3.0.41	affected	-
3.0.42	affected	-
3.0.43	affected	-
3.0.44	affected	-
3.0.45	affected	-
3.0.46	affected	-
3.0.47	affected	-
3.0.48	affected	-
3.0.49	affected	-
3.0.5	affected	-
3.0.50	affected	-
3.0.51	affected	-
3.0.52	affected	-
3.0.53	affected	-
3.0.54	affected	-
3.0.55	affected	-
3.0.56	affected	-
3.0.57	affected	-
3.0.58	affected	-
3.0.59	affected	-
3.0.6	affected	-
3.0.60	affected	-
3.0.61	affected	-
3.0.62	affected	-
3.0.63	affected	-
3.0.64	affected	-
3.0.65	affected	-
3.0.66	affected	-
3.0.67	affected	-
3.0.68	affected	-
3.0.69	affected	-
3.0.7	affected	-
3.0.70	affected	-
3.0.71	affected	-
3.0.72	affected	-
3.0.73	affected	-
3.0.74	affected	-
3.0.75	affected	-
3.0.76	affected	-
3.0.77	affected	-
3.0.78	affected	-
3.0.79	affected	-
3.0.8	affected	-
3.0.80	affected	-
3.0.81	affected	-
3.0.82	affected	-
3.0.83	affected	-
3.0.84	affected	-
3.0.85	affected	-
3.0.86	affected	-
3.0.87	affected	-
3.0.88	affected	-
3.0.89	affected	-
3.0.9	affected	-
3.0.90	affected	-
3.0.91	affected	-
3.0.92	affected	-
3.0.93	affected	-
3.0.94	affected	-
3.0.95	affected	-
3.0.96	affected	-
3.0.97	affected	-

@ai-sdk/provider-utils

npm

Introduced 4.0.0-beta.10 Fixed 4.0.33
@ai-sdk/provider-utils

npm

Introduced 5.0.0-beta.0 Fixed 5.0.1
@ai-sdk/provider-utils

npm

Introduced 0 Fixed 3.0.28

Ecosystem	Package	Introduced	Fixed
npm	@ai-sdk/provider-utils	4.0.0-beta.10	4.0.33
npm	@ai-sdk/provider-utils	5.0.0-beta.0	5.0.1
npm	@ai-sdk/provider-utils	0	3.0.28

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-400

Uncontrolled Resource Consumption

CWE-404

Improper Resource Shutdown or Release

References (14)

https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb
exploitThird Party Advisory
https://github.com/advisories/GHSA-866g-f22w-33x8
Advisory
https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md#501
https://github.com/vercel/ai/commit/6a436e31d247d678ddaedfc6f61e73ac0595e4b4
https://github.com/vercel/ai/commit/b30e43ac3fae2432a40b4f4f27f844f3d78b119e
https://github.com/vercel/ai/commit/b85c4fbc603b8173cf50a9790823397aada908a9
https://github.com/vercel/ai/pull/16374
https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@3.0.28
https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@4.0.33
https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@5.0.1
https://nvd.nist.gov/vuln/detail/CVE-2026-8769
https://vuldb.com/submit/811406
third-party-advisoryThird Party AdvisoryVDB Entry
https://vuldb.com/vuln/364394
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/vuln/364394/cti
signaturepermissions-requiredPermissions RequiredVDB Entry

Link	Providers	Tags
https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb		exploitThird Party Advisory
https://github.com/advisories/GHSA-866g-f22w-33x8		Advisory
https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md#501
https://github.com/vercel/ai/commit/6a436e31d247d678ddaedfc6f61e73ac0595e4b4
https://github.com/vercel/ai/commit/b30e43ac3fae2432a40b4f4f27f844f3d78b119e
https://github.com/vercel/ai/commit/b85c4fbc603b8173cf50a9790823397aada908a9
https://github.com/vercel/ai/pull/16374
https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@3.0.28
https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@4.0.33
https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@5.0.1
https://nvd.nist.gov/vuln/detail/CVE-2026-8769
https://vuldb.com/submit/811406		third-party-advisoryThird Party AdvisoryVDB Entry
https://vuldb.com/vuln/364394		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/vuln/364394/cti		signaturepermissions-requiredPermissions RequiredVDB Entry