CLSA-2026-1789472298 TuxCare security update for @ai-sdk/provider-utils (1 CVE)

TuxCare rebuilt @ai-sdk/provider-utils to address 1 CVE. Fixed in 3.0.27-tuxcare.1...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

0pflow (>=0.1.0-dev.2580522, <=0.1.0), 0xble (>=14.0.0, <=23.2.2) +12141 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=0.0.0, <=5.0.36)

@ai-sdk/provider-utils NPM version =0.0.0, =0.1.0-dev.2580522, =14.0.0, =1.1.5, =0.1.0, =1.0.0, =0.1.0, =1.0.0, =0.0.2, =0.1.6, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.64 and more Source cves: CVE-2026-8769 Source advisory: SNYK:JS-AISDKPROVIDERUTILS-16735288...

0pflow (>=0.1.0-dev.2580522, <=0.1.0), 0xble (>=14.0.0, <=23.2.2) +12141 more potentially affected by CVE-2026-8768 via @ai-sdk/provider-utils (>=0.0.0, <=5.0.36)

@ai-sdk/provider-utils NPM version =0.0.0, =0.1.0-dev.2580522, =14.0.0, =1.1.5, =0.1.0, =1.0.0, =0.1.0, =1.0.0, =0.0.2, =0.1.6, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.64 and more Source cves: CVE-2026-8768 Source advisory: SNYK:JS-AISDKPROVIDERUTILS-16734888...

0xble (>=22.0.0, <=23.2.2), @302ai/ai-sdk (>=0.1.0, <=0.1.1) +1608 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=3.0.0, <=3.0.27)

@ai-sdk/provider-utils NPM version =3.0.0, =22.0.0, =0.1.0, =0.0.1, =0.1.4, =0.2.5, =0.1.1, =0.0.4, =0.0.1, =0.3.0, =0.0.1, =0.0.4, =0.1.5 and more Source cves: CVE-2026-8769 Source advisory: OSV:GHSA-866G-F22W-33X8...

EUVD-2026-30712

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The...

@302ai/ai-sdk (>=0.2.0, <=0.2.17), @activepieces/piece-activecampaign (>=0.1.4, <=0.1.5) +2048 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=4.0.0, <=4.0.32)

@ai-sdk/provider-utils NPM version =4.0.0, =0.2.0, =0.1.4, =0.4.1, =0.1.1, =0.1.1, =0.0.1, =0.0.7, =0.1.1, =0.1.1, =0.0.1, =0.1.1, =0.1.1, =0.1.5 and more Source cves: CVE-2026-8769 Source advisory: OSV:GHSA-866G-F22W-33X8...

@agentproto/adapter-mastracode-inprocess (>=0.2.0, <=0.2.6), @ai-sdk-tools/artifacts (>=0.10.0, <=0.12.0) +206 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (5.0.0-canary.48)

@ai-sdk/provider-utils NPM version 5.0.0-canary.48 is affected by a known vulnerability. The following packages have a transitive dependency on @ai-sdk/provider-utils and may be impacted: - @agentproto/adapter-mastracode-inprocess =0.2.0, =0.10.0, =0.11.0, =0.10.0, =0.9.1, =2.0.0-beta.0,...

GHSA-866G-F22W-33X8 @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

Versions of @ai-sdk/provider-utils before 3.0.28, from 4.0.0 before 4.0.33, and from 5.0.0 before 5.0.1 are vulnerable to uncontrolled resource consumption. The createJsonResponseHandler, createJsonErrorResponseHandler, and createStatusCodeErrorResponseHandler functions in...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

CVE-2026-8769

CVE-2026-8769 affects vercel ai up to 3.0.97, specifically the provider-utils file response-handler.ts (functions createJsonResponseHandler and createJsonErrorResponseHandler). The issue enables resource consumption that can be triggered remotely; exploit publicly disclosed. Details on affected v...

CVE-2026-8769 vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The...

CVE-2026-8768

CVE-2026-8768 affects vercel ai up to 3.0.97, specifically the provider-utils component and its function validateDownloadUrl in packages/provider-utils/src/download-blob.ts. The vulnerability enables server-side request forgery (SSRF) and can be triggered remotely. The exploit has been made publi...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

PT-2026-41588

Name of the Vulnerable Software and Affected Versions vercel ai versions prior to 3.0.98 Description A resource consumption issue exists in the provider-utils component. The flaw is located within the createJsonResponseHandler and createJsonErrorResponseHandler functions in the...

Vercel AI SDK 代码问题漏洞

Vercel AI SDK is a JavaScript SDK developed by Vercel that supports the integration of large language models, streaming responses, and AI application development. Versions of Vercel AI 3.0.97 and earlier contain code vulnerabilities. These vulnerabilities stem from the validateDownloadUrl functio...