CLSA-2026-1793272798 TuxCare security update for @ai-sdk/provider-utils (1 CVE)

TuxCare rebuilt @ai-sdk/provider-utils to address 1 CVE. Fixed in 4.0.27-tuxcare.1...

CLSA-2026-1793271692 TuxCare security update for @ai-sdk/provider-utils (1 CVE)

TuxCare rebuilt @ai-sdk/provider-utils to address 1 CVE. Fixed in 2.2.8-tuxcare.2...

CLSA-2026-1792161536 TuxCare security update for @ai-sdk/provider-utils (1 CVE)

TuxCare rebuilt @ai-sdk/provider-utils to address 1 CVE. Fixed in 3.0.27-tuxcare.1...

PT-2026-124117

TuxCare rebuilt @ai-sdk/provider-utils to address 1 CVE. Fixed in 3.0.27-tuxcare.1...

CLSA-2026-1789472298 TuxCare security update for @ai-sdk/provider-utils (1 CVE)

TuxCare rebuilt @ai-sdk/provider-utils to address 1 CVE. Fixed in 3.0.27-tuxcare.1...

PT-2026-99033

TuxCare rebuilt @ai-sdk/provider-utils to address 1 CVE. Fixed in 3.0.27-tuxcare.1...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

0pflow (>=0.1.0-dev.2580522, <=0.1.0), 0xble (>=14.0.0, <=23.2.2) +13932 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=0.0.0-01d6317c-20260129172110, <=5.0.72)

@ai-sdk/provider-utils NPM version =0.0.0-01d6317c-20260129172110, =0.1.0-dev.2580522, =14.0.0, =1.1.5, =0.1.0, =1.0.0, =0.1.0, =1.0.0, =0.0.2, =0.1.6, =0.1.0, =0.6.0 and more Source cves: CVE-2026-8769 Source advisory: SNYK:JS-AISDKPROVIDERUTILS-16735288...

0pflow (>=0.1.0-dev.2580522, <=0.1.0), 0xble (>=14.0.0, <=23.2.2) +13932 more potentially affected by CVE-2026-8768 via @ai-sdk/provider-utils (>=0.0.0-01d6317c-20260129172110, <=5.0.72)

@ai-sdk/provider-utils NPM version =0.0.0-01d6317c-20260129172110, =0.1.0-dev.2580522, =14.0.0, =1.1.5, =0.1.0, =1.0.0, =0.1.0, =1.0.0, =0.0.2, =0.1.6, =0.1.0, =0.6.0 and more Source cves: CVE-2026-8768 Source advisory: SNYK:JS-AISDKPROVIDERUTILS-16734888...

@302ai/ai-sdk (>=0.2.0, <=0.2.17), @acedatacloud/piece-fish-audio (>=0.1.0, <=0.1.1) +2349 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=4.0.0-beta.10, <=4.0.32)

@ai-sdk/provider-utils NPM version =4.0.0-beta.10, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.4, =0.4.1, =0.1.1, =0.1.1, =0.0.1, =0.0.3 - @activepieces/piece-afforai 0.1.4 and more Source cves: CVE-2026-8769 Source advisory: OSV:GHSA-866G-F22W-33X8...

0xble (>=22.0.0, <=23.2.2), @302ai/ai-sdk (>=0.1.0, <=0.1.1) +1644 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=3.0.0-alpha.1, <=3.0.27)

@ai-sdk/provider-utils NPM version =3.0.0-alpha.1, =22.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.4, =0.2.5, =0.1.1, =0.1.5 and more Source cves: CVE-2026-8769 Source advisory: GHSA-866G-F22W-33X8...

@ai-sdk-tools/artifacts (>=0.10.0, <=0.12.0), @ai-sdk-tools/cache (>=0.11.0, <=0.13.0) +217 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=5.0.0-beta.0, <=5.0.0)

@ai-sdk/provider-utils NPM version =5.0.0-beta.0, =0.10.0, =0.11.0, =0.10.0, =0.9.1, =2.0.0-beta.0, =5.0.0-beta.0, =3.0.0-beta.0, =4.0.0-beta.0, =1.0.0-beta.8, =3.0.0-beta.0, =4.0.0-beta.0, =2.0.0-beta.0, =2.0.0-beta.0, =3.0.0-beta.0, =4.0.0-beta.0, =4.0.0 and more Source cves: CVE-2026-8769 Sour...

@302ai/ai-sdk (>=0.2.0, <=0.2.17), @acedatacloud/piece-fish-audio (>=0.1.0, <=0.1.1) +2349 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=4.0.0-beta.10, <=4.0.32)

@ai-sdk/provider-utils NPM version =4.0.0-beta.10, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.4, =0.4.1, =0.1.1, =0.1.1, =0.0.1, =0.0.3 - @activepieces/piece-afforai 0.1.4 and more Source cves: CVE-2026-8769 Source advisory: GHSA-866G-F22W-33X8...

0xble (>=22.0.0, <=23.2.2), @302ai/ai-sdk (>=0.1.0, <=0.1.1) +1644 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=3.0.0-alpha.1, <=3.0.27)

@ai-sdk/provider-utils NPM version =3.0.0-alpha.1, =22.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.4, =0.2.5, =0.1.1, =0.1.5 and more Source cves: CVE-2026-8769 Source advisory: OSV:GHSA-866G-F22W-33X8...

@ai-sdk-tools/artifacts (>=0.10.0, <=0.12.0), @ai-sdk-tools/cache (>=0.11.0, <=0.13.0) +217 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=5.0.0-beta.0, <=5.0.0)

@ai-sdk/provider-utils NPM version =5.0.0-beta.0, =0.10.0, =0.11.0, =0.10.0, =0.9.1, =2.0.0-beta.0, =5.0.0-beta.0, =3.0.0-beta.0, =4.0.0-beta.0, =1.0.0-beta.8, =3.0.0-beta.0, =4.0.0-beta.0, =2.0.0-beta.0, =2.0.0-beta.0, =3.0.0-beta.0, =4.0.0-beta.0, =4.0.0 and more Source cves: CVE-2026-8769 Sour...

EUVD-2026-30712

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The...

GHSA-866G-F22W-33X8 @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

Versions of @ai-sdk/provider-utils before 3.0.28, from 4.0.0 before 4.0.33, and from 5.0.0 before 5.0.1 are vulnerable to uncontrolled resource consumption. The createJsonResponseHandler, createJsonErrorResponseHandler, and createStatusCodeErrorResponseHandler functions in...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

CVE-2026-8769

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The...

CVE-2026-8769

CVE-2026-8769 affects vercel ai up to 3.0.97, specifically the provider-utils file response-handler.ts (functions createJsonResponseHandler and createJsonErrorResponseHandler). The issue enables resource consumption that can be triggered remotely; exploit publicly disclosed. Details on affected v...