@ai-sdk/provider-utils is vulnerable to Denial of Service (DoS)
65
Medium Risk
@ai-sdk/provider-utils converts Uint8Array file parts to base64 by appending one character per byte into a single JavaScript string before calling btoa. Encoding a large byte array, such as an uploaded image or file attachment, builds many large intermediate strings and can exhaust the process heap. A byte array of roughly 14 MB reproducibly triggers a V8 out-of-memory crash that terminates the running process. The fix converts the array in bounded 4,096-byte chunks and joins them once before base64 encoding.
You are affected if you are using a version that falls within the vulnerable range and your application converts large binary file or image data to base64 through this library.
@ai-sdk/provider-utils is vulnerable to Denial of Service (DoS) in versions 0.0.0 - 3.0.36, 4.0.0 - 4.0.51 and 5.0.0 - 5.0.36.
Upgrade the @ai-sdk/provider-utils library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.