Vercel AI SDK vulnerabilities and security advisories

$ latest 2

• lowMay 18, 2026

  @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

  • @ai-sdk/provider-utils < 3.0.28 · fixed in 3.0.28
  • @ai-sdk/provider-utils >= 4.0.0-beta.10, < 4.0.33 · fixed in 4.0.33
  • @ai-sdk/provider-utils >= 5.0.0-beta.0, < 5.0.1 · fixed in 5.0.1
  GHSA-866g-f22w-33x8CVE-2026-8769

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-866g-f22w-33x8 (CVE-2026-8769), severity low
  What it is: @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue
  Affected packages:
  - @ai-sdk/provider-utils: affected versions < 3.0.28. Fixed in 3.0.28.
  - @ai-sdk/provider-utils: affected versions >= 4.0.0-beta.10, < 4.0.33. Fixed in 4.0.33.
  - @ai-sdk/provider-utils: affected versions >= 5.0.0-beta.0, < 5.0.1. Fixed in 5.0.1.
  Details: https://github.com/advisories/GHSA-866g-f22w-33x8
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

• lowNov 7, 2025

  Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

  • ai < 5.0.52 · fixed in 5.0.52
  • ai >= 5.1.0-beta.0, < 5.1.0-beta.9 · fixed in 5.1.0-beta.9
  GHSA-rwvc-j5jr-mgvhCVE-2025-48985

  prompt for your AI agent

  paste into your agent⧉Copy

  A security advisory covers a package this project may use.
  
  Advisory: GHSA-rwvc-j5jr-mgvh (CVE-2025-48985), severity low
  What it is: Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files
  Affected packages:
  - ai: affected versions < 5.0.52. Fixed in 5.0.52.
  - ai: affected versions >= 5.1.0-beta.0, < 5.1.0-beta.9. Fixed in 5.1.0-beta.9.
  Details: https://github.com/advisories/GHSA-rwvc-j5jr-mgvh
  
  Please:
  1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
  2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
  3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
  4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
  5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
  6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.