{
  "@id": "urn:uuid:662ba243-19c0-41ea-a3e0-c8b1f97e1905",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T21:10:00.349423+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40ai-sdk/provider-utils@4.0.47",
          "identifiers": {
            "purl": "pkg:npm/%40ai-sdk/provider-utils@4.0.47"
          }
        }
      ],
      "timestamp": "2026-11-03T21:10:00.349423+00:00",
      "status_notes": "Vulnerability CVE-2026-8769 does not affect version 4.0.47 of @ai-sdk/provider-utils. not_affected \u2014 The target @ai-sdk/provider-utils version 4.0.47 is NOT AFFECTED by CVE-2026-8769. The vulnerable pattern (unbounded response body reading) is not present in the current version. The upstream fix was already included in the 4.0.47 release that TuxCare onboarded. The three vulnerable functions (createJsonResponseHandler, createJsonErrorResponseHandler, createStatusCodeErrorResponseHandler) all u...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8769"
      },
      "impact_statement": "not_affected \u2014 The target @ai-sdk/provider-utils version 4.0.47 is NOT AFFECTED by CVE-2026-8769. The vulnerable pattern (unbounded response body reading) is not present in the current version. The upstream fix was already included in the 4.0.47 release that TuxCare onboarded. The three vulnerable functions (createJsonResponseHandler, createJsonErrorResponseHandler, createStatusCodeErrorResponseHandler) all u..."
    }
  ]
}