Update npm package @ai-sdk/provider-utils to v4.0.33 [SECURITY]

[hash-dependencies]

This PR contains the following updates:

Package	Change	Age	Confidence
@ai-sdk/provider-utils (source)	4.0.21 → 4.0.33

---

@​ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

CVE-2026-8769 / GHSA-866g-f22w-33x8

More information

Details

Versions of @ai-sdk/provider-utils before 3.0.28, from 4.0.0 before 4.0.33, and from 5.0.0 before 5.0.1 are vulnerable to uncontrolled resource consumption. The createJsonResponseHandler, createJsonErrorResponseHandler, and createStatusCodeErrorResponseHandler functions in packages/provider-utils/src/response-handler.ts read response bodies without a shared size limit, allowing a remote attacker with low privileges to cause excessive memory consumption. The exploit has been publicly disclosed and may be utilized.

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-8769
• https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb
• https://vuldb.com/submit/811406
• https://vuldb.com/vuln/364394
• https://vuldb.com/vuln/364394/cti
• https://github.com/vercel/ai/pull/16374
• https://github.com/vercel/ai/commit/6a436e31d247d678ddaedfc6f61e73ac0595e4b4
• https://github.com/vercel/ai/commit/b30e43ac3fae2432a40b4f4f27f844f3d78b119e
• https://github.com/vercel/ai/commit/b85c4fbc603b8173cf50a9790823397aada908a9
• https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md#501
• https://github.com/vercel/ai/releases/tag/@​ai-sdk/provider-utils@3.0.28
• https://github.com/vercel/ai/releases/tag/@​ai-sdk/provider-utils@4.0.33
• https://github.com/vercel/ai/releases/tag/@​ai-sdk/provider-utils@5.0.1
• https://github.com/advisories/GHSA-866g-f22w-33x8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vercel/ai (@​ai-sdk/provider-utils)

v4.0.33

Compare Source

Patch Changes

• b30e43a: Limit JSON response body reads in response handlers to prevent unbounded memory use.

v4.0.32

Compare Source

Patch Changes

• Updated dependencies [f19334d]
  • @​ai-sdk/provider@​3.0.12

v4.0.31

Patch Changes

• 1b40ac7: Publish all packages under the @ai-v6 dist tag.
• Updated dependencies [1b40ac7]
  • @​ai-sdk/provider@​3.0.11

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[cursor]

PR Summary

Medium Risk
Security dependency patch for AI SDK HTTP response handling; risk is limited to lockfile resolution, but nested @ai-sdk/react may still pull the pre-patch provider-utils version.

Overview
Lockfile-only update that resolves @ai-sdk/provider-utils from 4.0.21 to 4.0.33, addressing CVE-2026-8769 (unbounded reads of HTTP response bodies in JSON/status error handlers, which could drive excessive memory use).

The bump also refreshes related locked versions (@ai-sdk/provider 3.0.12, eventsource-parser 3.1.1). There is no application source change—only package-lock.json. Note that @ai-sdk/react still nests @ai-sdk/provider-utils@4.0.21 in the lockfile, so some code paths may keep using the older copy until that dependency tree is updated separately.

^{Reviewed by Cursor Bugbot for commit a4f1498. Bugbot is set up for automated code reviews on this repo. Configure here.}