{
  "@id": "urn:uuid:7090955b-61b0-442b-8c8a-3981212133c1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T21:09:41.874958+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40ai-sdk/provider-utils@4.0.48",
          "identifiers": {
            "purl": "pkg:npm/%40ai-sdk/provider-utils@4.0.48"
          }
        }
      ],
      "timestamp": "2026-11-03T21:09:41.874958+00:00",
      "status_notes": "Vulnerability CVE-2026-8769 does not affect version 4.0.48 of @ai-sdk/provider-utils. not_affected \u2014 Version 4.0.48 of @ai-sdk/provider-utils is not affected by CVE-2026-8769. The vulnerability (uncontrolled resource consumption in response handlers) was fixed in the upstream release via commit b30e43ac3f, which added size limits to all JSON response handlers before version 4.0.33 was released. The current version already contains the defense mechanism (readResponseWithSizeLimit with a 2 GiB d...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8769"
      },
      "impact_statement": "not_affected \u2014 Version 4.0.48 of @ai-sdk/provider-utils is not affected by CVE-2026-8769. The vulnerability (uncontrolled resource consumption in response handlers) was fixed in the upstream release via commit b30e43ac3f, which added size limits to all JSON response handlers before version 4.0.33 was released. The current version already contains the defense mechanism (readResponseWithSizeLimit with a 2 GiB d..."
    }
  ]
}