Medium severity4.3NVD Advisory· Published May 17, 2026· Updated May 19, 2026
CVE-2026-8769
CVE-2026-8769
Description
A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@ai-sdk/provider-utilsnpm | <= 3.0.97 | — |
Affected products
3- osv-coords2 versions
< 2.95.12-r28+ 1 more
- (no CPE)range: < 2.95.12-r28
- (no CPE)range: < 2.95.12-r30
Patches
Vulnerability mechanics
References
6- gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bbnvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-866g-f22w-33x8ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-8769ghsaADVISORY
- vuldb.com/submit/811406nvdThird Party AdvisoryVDB EntryWEB
- vuldb.com/vuln/364394nvdThird Party AdvisoryVDB EntryWEB
- vuldb.com/vuln/364394/ctinvdPermissions RequiredVDB EntryWEB
News mentions
1- Vercel AI SDK: Three CVEs Disclosed in provider-utils Package — SSRF, Resource Exhaustion, and CI Command InjectionVypr Intelligence · May 17, 2026