EUVD-2026-30712
GHSA-866g-f22w-33x8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to target application
-
ExploitSend crafted JSON to AI endpoint
-
ExecutionTrigger excessive resource allocation in response handler
-
ImpactDegrade service availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access (PR:L) to an application using Vercel AI SDK versions ≤3.0.97. Specifically exploitable when the application invokes createJsonResponseHandler or createJsonErrorResponseHandler functions in the provider-utils package to process AI provider responses. Attack surface is limited to network-accessible endpoints that accept user-controlled data passed to these JSON response handlers. Exploitation is bounded by authentication requirements - not exploitable by anonymous attackers against default configurations. Rate limiting, WAF rules, or SDK-level resource quotas would further limit exploitation feasibility. |
| Impact | Real-world risk is LOW despite the availability of public exploit code. CVSS 4.0 vector analysis reveals: network-accessible (AV:N) with low complexity (AC:L) but requires authentication (PR:L), limiting the attack surface to authorized users or compromised accounts. Impact is confined to low availability degradation (VA:L) with no confidentiality or integrity effects (VC:N/VI:N). Exploit maturity indicator (E:P) confirms proof-of-concept exists, but absence from CISA KEV and the 2.1 severity score indicate no evidence of real-world exploitation campaigns. The requirement for authentication significantly reduces exploitation probability compared to unauthenticated resource consumption flaws. SSVC prioritization would likely categorize this as 'scheduled' rather than urgent - the technical impact is limited to service degradation, not system compromise, and exploitation is not automatable at scale without credential access. Primary concern is for high-volume AI applications where authenticated users could intentionally degrade service quality, but defense-in-depth measures like rate limiting and resource quotas typically mitigate such attacks independently of patching. |
| Exploit ScenarioDerived | An authenticated user with valid credentials to an application using Vercel AI SDK sends a specially crafted request containing malicious JSON structures designed to trigger excessive resource consumption in the createJsonResponseHandler function. The handler attempts to process the adversarial JSON payload without adequate resource constraints, causing the application to allocate excessive memory or CPU cycles. This degrades service availability for other users, potentially causing timeouts or service slowdowns. With public POC code available and low attack complexity (AC:L), exploitation is straightforward for any authenticated user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 17, 2026
Resource exhaustion in Vercel AI SDK's provider-utils package (versions ≤3.0.97) allows authenticated remote attackers to consume excessive system resources via specially crafted requests to JSON response handlers. Public proof-of-concept exists. EPSS data not available. Not listed in CISA KEV. CVSS 4.0 score of 2.1 reflects low availability impact (VA:L) with authenticated network access (PR:L). Vendor non-responsive to initial disclosure.
RemediationAI
No vendor-released patch identified at time of analysis - Vercel did not respond to initial vulnerability disclosure per VulDB submission 811406. Organizations using Vercel AI SDK ≤3.0.97 should implement compensating controls: Apply rate limiting at the application layer to restrict request frequency per authenticated user (limit: 10-50 requests/minute depending on use case; trade-off: may impact legitimate high-volume users). Configure resource quotas for SDK operations using container memory limits or Node.js --max-old-space-size flag (trade-off: may cause crashes under legitimate load spikes rather than graceful degradation). Deploy request timeout enforcement (recommended: 30-60 seconds for AI operations; trade-off: may prematurely terminate valid long-running AI requests). Monitor resource consumption metrics for anomalies using application performance monitoring tools. Check Vercel AI SDK GitHub repository (vercel/ai) for community patches or newer releases beyond 3.0.97 that may address the issue. Public POC available at https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb for testing effectiveness of mitigations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the provider-utils package of the Vercel AI SDK, specifically in the createJsonResponseHandler and createJsonErrorResponseHandler functions within response-handler.ts. Classified as CWE-400 (Uncontrolled Resource Consumption), this indicates insufficient limits on resource allocation when processing JSON responses. The Vercel AI SDK provides abstractions for working with AI model providers, and the affected response handlers are likely involved in parsing and processing JSON payloads from AI service responses. Without proper input validation or resource constraints, specially crafted JSON structures could trigger excessive memory allocation, CPU consumption, or processing time, leading to denial of service conditions for the application using the SDK.
Know when Ai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
discourse-ai is the AI plugin for the open-source discussion platform Discourse. Rated high severity (CVSS 7.2), this vu
Server-side request forgery in Vercel AI SDK versions up to 3.0.97 allows remote unauthenticated attackers to forge requ
OS command injection in Vercel AI SDK versions up to 3.0.97 allows authenticated remote attackers with pull request crea
A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. Rated low severity (
Exploit-DB