PT-2026-41588 · Vercel · Vercel Ai

Eric-F · Published 2026-05-17 · Updated 2026-05-18 · CVE-2026-8769

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions vercel ai versions prior to 3.0.98

Description A resource consumption issue exists in the provider-utils component. The flaw is located within the createJsonResponseHandler() and createJsonErrorResponseHandler() functions in the packages/provider-utils/src/response-handler.ts file. This allows a remote attacker to cause excessive resource consumption.

Recommendations Update to version 3.0.98 or later. As a temporary workaround, restrict access to the createJsonResponseHandler() and createJsonErrorResponseHandler() functions until the update is applied.

Exploit

Fix

Resource Exhaustion

Improper Resource Release

Weakness Enumeration

CWE-400

CWE-404

Related Identifiers

CVE-2026-8769

GHSA-866G-F22W-33X8

Affected Products

Vercel Ai

References · 10

• 🔥 https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb · Exploit
• https://osv.dev/vulnerability/GHSA-866g-f22w-33x8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8769 · Security Note
• https://github.com/vercel/ai · Note
• https://t.me/CVEtracker/54080 · Telegram Post
• https://vuldb.com/submit/811406 · Note
• https://vuldb.com/vuln/364394 · Note
• https://twitter.com/VulmonFeeds/status/2056156402201010317 · Twitter Post
• https://vuldb.com/vuln/364394/cti · Note
• https://twitter.com/CVEnew/status/2056253257064800719 · Twitter Post