CLSA-2026-1789472298 TuxCare security update for @ai-sdk/provider-utils (1 CVE)

TuxCare rebuilt @ai-sdk/provider-utils to address 1 CVE. Fixed in 3.0.27-tuxcare.1...

PT-2026-99033

TuxCare rebuilt @ai-sdk/provider-utils to address 1 CVE. Fixed in 3.0.27-tuxcare.1...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

0pflow (>=0.1.0-dev.2580522, <=0.1.0), 0xble (>=14.0.0, <=23.2.2) +13380 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=0.0.0-01d6317c-20260129172110, <=5.0.58)

@ai-sdk/provider-utils NPM version =0.0.0-01d6317c-20260129172110, =0.1.0-dev.2580522, =14.0.0, =1.1.5, =0.1.0, =1.0.0, =0.1.0, =1.0.0, =0.0.2, =0.1.6, =0.1.0, =0.4.2 and more Source cves: CVE-2026-8769 Source advisory: SNYK:JS-AISDKPROVIDERUTILS-16735288...

0xble (>=22.0.0, <=23.2.2), @302ai/ai-sdk (>=0.1.0, <=0.1.1) +1624 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=3.0.0-alpha.1, <=3.0.27)

@ai-sdk/provider-utils NPM version =3.0.0-alpha.1, =22.0.0, =0.1.0, =0.1.0, =0.0.1, =0.1.4, =0.2.5, =0.1.1, =0.0.4, =0.0.1, =0.0.3 - @activepieces/piece-afforai 0.1.4 and more Source cves: CVE-2026-8769 Source advisory: OSV:GHSA-866G-F22W-33X8...

0xble (>=22.0.0, <=23.2.2), @302ai/ai-sdk (>=0.1.0, <=0.1.1) +1624 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=3.0.0-alpha.1, <=3.0.27)

@ai-sdk/provider-utils NPM version =3.0.0-alpha.1, =22.0.0, =0.1.0, =0.1.0, =0.0.1, =0.1.4, =0.2.5, =0.1.1, =0.0.4, =0.0.1, =0.0.3 - @activepieces/piece-afforai 0.1.4 and more Source cves: CVE-2026-8769 Source advisory: GHSA-866G-F22W-33X8...

GHSA-866G-F22W-33X8 @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

Versions of @ai-sdk/provider-utils before 3.0.28, from 4.0.0 before 4.0.33, and from 5.0.0 before 5.0.1 are vulnerable to uncontrolled resource consumption. The createJsonResponseHandler, createJsonErrorResponseHandler, and createStatusCodeErrorResponseHandler functions in...

@302ai/ai-sdk (>=0.2.0, <=0.2.17), @acedatacloud/piece-gpt-image (0.1.0) +2408 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=4.0.0-beta.10, <=4.0.32)

@ai-sdk/provider-utils NPM version =4.0.0-beta.10, =0.2.0, =0.1.0, =0.1.4, =0.4.1, =0.1.1, =0.1.1, =0.0.1, =0.0.7, =0.1.1, =0.1.5 and more Source cves: CVE-2026-8769 Source advisory: OSV:GHSA-866G-F22W-33X8...

@agentproto/adapter-mastracode-inprocess (>=0.2.0, <=0.2.6), @ai-sdk-tools/artifacts (>=0.10.0, <=0.12.0) +222 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=5.0.0-beta.0, <=5.0.0)

@ai-sdk/provider-utils NPM version =5.0.0-beta.0, =0.2.0, =0.10.0, =0.11.0, =0.10.0, =0.9.1, =2.0.0-beta.0, =5.0.0-beta.0, =3.0.0-beta.0, =4.0.0-beta.0, =1.0.0-beta.8, =3.0.0-beta.0, =4.0.0-beta.0, =2.0.0-beta.0, =2.0.0-beta.0, =3.0.0-beta.0, =3.0.0 and more Source cves: CVE-2026-8769 Source...

EUVD-2026-30712

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

CVE-2026-8769

CVE-2026-8769 affects vercel ai up to 3.0.97, specifically the provider-utils file response-handler.ts (functions createJsonResponseHandler and createJsonErrorResponseHandler). The issue enables resource consumption that can be triggered remotely; exploit publicly disclosed. Details on affected v...

CVE-2026-8769

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The...

CVE-2026-8769 vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The...

@302ai/ai-sdk (>=0.2.0, <=0.2.17), @acedatacloud/piece-gpt-image (0.1.0) +2408 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=4.0.0-beta.10, <=4.0.32)

@ai-sdk/provider-utils NPM version =4.0.0-beta.10, =0.2.0, =0.1.0, =0.1.4, =0.4.1, =0.1.1, =0.1.1, =0.0.1, =0.0.7, =0.1.1, =0.1.5 and more Source cves: CVE-2026-8769 Source advisory: MEND:CVE-2026-8769...

@agentproto/adapter-mastracode-inprocess (>=0.2.0, <=0.2.6), @ai-sdk-tools/artifacts (>=0.10.0, <=0.12.0) +222 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=5.0.0-beta.0, <=5.0.0)

@ai-sdk/provider-utils NPM version =5.0.0-beta.0, =0.2.0, =0.10.0, =0.11.0, =0.10.0, =0.9.1, =2.0.0-beta.0, =5.0.0-beta.0, =3.0.0-beta.0, =4.0.0-beta.0, =1.0.0-beta.8, =3.0.0-beta.0, =4.0.0-beta.0, =2.0.0-beta.0, =2.0.0-beta.0, =3.0.0-beta.0, =3.0.0 and more Source cves: CVE-2026-8769 Source...

CVE-2026-8768

CVE-2026-8768 affects vercel ai up to 3.0.97, specifically the provider-utils component and its function validateDownloadUrl in packages/provider-utils/src/download-blob.ts. The vulnerability enables server-side request forgery (SSRF) and can be triggered remotely. The exploit has been made publi...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

Vercel AI SDK 代码问题漏洞

Vercel AI SDK is a JavaScript SDK developed by Vercel that supports the integration of large language models, streaming responses, and AI application development. Versions of Vercel AI 3.0.97 and earlier contain code vulnerabilities. These vulnerabilities stem from the validateDownloadUrl functio...

CVE-2026-8768: Server-Side Request Forgery (SSRF)

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...