CVE-2026-40608: Next AI Draw.io: Unbounded HTTP Body — Denial of Service

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-21 · updated 2026-10-26
Weakness: CWE-770

Description

Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers (/api/state, /api/restore, and /api/history-svg) that process incoming requests by accumulating the entire request body into a JavaScript string without any size limitations. Node.js buffers the entire payload in the V8 heap. Sending a sufficiently large body (e.g., 500 MiB or more) will exhaust the process heap memory, leading to an Out-of-Memory (OOM) error that crashes the MCP server. This vulnerability is fixed in 0.4.15.

Affected products

DayuanJiang next-ai-draw-io: before 0.4.15 — fixed in 0.4.15

How to fix

Upgrade to a fixed version: DayuanJiang next-ai-draw-io 0.4.15. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-40608 or the next vulnerability affects your stack