Medium severity · published May 17, 2026
CVE-2026-8769
vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
ai · vercel
3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +34 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8769
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8769
Exploit
https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb
Third Party Advisory
https://vuldb.com/submit/811406
Third Party Advisory
https://vuldb.com/vuln/364394
Permissions Required
https://vuldb.com/vuln/364394/cti
More from ai
7.5
CVE-2026-8767
vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection
7.3
CVE-2026-8768
vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery
5.3
CVE-2025-48985
A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta