This vulnerability affects the vercel ai product up to version 3.0.97 in the provider-utils component, specifically the createJsonResponseHandler and createJsonErrorResponseHandler functions. An attacker can remotely trigger excessive resource consumption through manipulation of these functions. The vulnerability is publicly disclosed, but no patch or official fix has been released by the vendor. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on availability.

Successful exploitation of this vulnerability can lead to resource consumption on the affected system, potentially degrading performance or availability. There is no indication of data confidentiality or integrity impact. The attack can be initiated remotely without authentication or user interaction. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, monitor official channels for updates. Until a patch is available, consider implementing resource usage limits or other environment-level controls to mitigate potential impact.