CVE-2026-8769

MediumCVSS 4.3

Published: 17/05/2026(UTC)Updated: 14/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.73%

53th percentile - higher than 53% of all known CVEs

Summary

A vulnerability was determined in vercel ai up to 3.0.97, affecting the createJsonResponseHandler/createJsonErrorResponseHandler functions in packages/provider-utils/src/response-handler.ts within the provider-utils component. The manipulation causes resource consumption, and the attack may be initiated remotely. The exploit has been publicly disclosed and the vendor did not respond to the disclosure.

Risk Assessment

A remote attacker can cause excessive resource consumption, leading to denial of service or performance degradation of the application. Public exploit availability increases the risk of exploitation.

Recommendation

Update vercel ai to a version newer than 3.0.97 or apply the vendor fix when available. Until then, limit API exposure and monitor resource usage.

Other vulnerabilities in vercel ai

CVE-2026-8767Medium
A vulnerability has been found in vercel ai up to version 3.0.97, affecting the run function in the file .github/workflows/prettier-on-automerge.yml related to PR Branch Name Interpolation. The manipulation leads to OS command injection. The attack can be initiated remotely, though its complexity is rather high and exploitability is considered difficult.

Original NVD description (English source)

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS