{
  "@id": "urn:uuid:fd1ed758-76bb-4bc2-87e7-62b4c8b5031e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T21:06:00.191158+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/%40ai-sdk/provider-utils@4.0.37",
          "identifiers": {
            "purl": "pkg:npm/%40ai-sdk/provider-utils@4.0.37"
          }
        }
      ],
      "timestamp": "2026-11-03T21:06:00.191158+00:00",
      "status_notes": "Vulnerability CVE-2026-8769 does not affect version 4.0.37 of @ai-sdk/provider-utils. not_affected \u2014 CVE-2026-8769 affects uncontrolled resource consumption in response body reading. The target repository at version 4.0.37 is NOT AFFECTED because the vulnerable code pattern is not present. The three functions mentioned in the CVE (createJsonResponseHandler, createJsonErrorResponseHandler, createStatusCodeErrorResponseHandler) all use readResponseWithSizeLimit with a 2 GiB default size limit, p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-8769"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-8769 affects uncontrolled resource consumption in response body reading. The target repository at version 4.0.37 is NOT AFFECTED because the vulnerable code pattern is not present. The three functions mentioned in the CVE (createJsonResponseHandler, createJsonErrorResponseHandler, createStatusCodeErrorResponseHandler) all use readResponseWithSizeLimit with a 2 GiB default size limit, p..."
    }
  ]
}