Intel

AIKIDO-2026-526145

@ai-sdk/provider-utils is vulnerable to Denial of Service (DoS)

Denial of Service (DoS) Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Yesterday

65

Medium Risk

This Affects:

JS@ai-sdk/provider-utils
0.0.0 - 3.0.36
Fixed in 3.0.37
4.0.0 - 4.0.51
Fixed in 4.0.52
5.0.0 - 5.0.36
Fixed in 5.0.37
Are you affected? Scan for Free

TL;DR

@ai-sdk/provider-utils converts Uint8Array file parts to base64 by appending one character per byte into a single JavaScript string before calling btoa. Encoding a large byte array, such as an uploaded image or file attachment, builds many large intermediate strings and can exhaust the process heap. A byte array of roughly 14 MB reproducibly triggers a V8 out-of-memory crash that terminates the running process. The fix converts the array in bounded 4,096-byte chunks and joins them once before base64 encoding.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application converts large binary file or image data to base64 through this library.

Background info

@ai-sdk/provider-utils is vulnerable to Denial of Service (DoS) in versions 0.0.0 - 3.0.36, 4.0.0 - 4.0.51 and 5.0.0 - 5.0.36.

How to fix this

Upgrade the @ai-sdk/provider-utils library to the patch version.

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform