CVE-2026-40608

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-40608
Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers (/api/state, /api/restore, and /api/history-svg) that process incoming requests by accumulating the entire request body into a JavaScript string without any size limitations. Node.js buffers the entire payload in the V8 heap. Sending a sufficiently large body (e.g., 500 MiB or more) will exhaust the process heap memory, leading to an Out-of-Memory (OOM) error that crashes the MCP server. This vulnerability is fixed in 0.4.15.

6.2 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/DayuanJiang/next-ai-draw-io/commit/31819f413cc4b329a1cb81e5fccd0cd98c1fd665 Patch
https://github.com/DayuanJiang/next-ai-draw-io/security/advisories/GHSA-9q7h-wgfw-p378 Exploit Mitigation Vendor Advisory
https://github.com/DayuanJiang/next-ai-draw-io/security/advisories/GHSA-9q7h-wgfw-p378 Exploit Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:dayuanjiang:next_ai_draw.io:*:*:*:*:*:*:*:*
History

27 Apr 2026, 19:41

Type Values Removed Values Added
First Time Dayuanjiang
Dayuanjiang next Ai Draw.io
CPE cpe:2.3:a:dayuanjiang:next_ai_draw.io:*:*:*:*:*:*:*:*
References () https://github.com/DayuanJiang/next-ai-draw-io/commit/31819f413cc4b329a1cb81e5fccd0cd98c1fd665 - () https://github.com/DayuanJiang/next-ai-draw-io/commit/31819f413cc4b329a1cb81e5fccd0cd98c1fd665 - Patch
References () https://github.com/DayuanJiang/next-ai-draw-io/security/advisories/GHSA-9q7h-wgfw-p378 - () https://github.com/DayuanJiang/next-ai-draw-io/security/advisories/GHSA-9q7h-wgfw-p378 - Exploit, Mitigation, Vendor Advisory

21 Apr 2026, 19:16

Type Values Removed Values Added
References () https://github.com/DayuanJiang/next-ai-draw-io/security/advisories/GHSA-9q7h-wgfw-p378 - () https://github.com/DayuanJiang/next-ai-draw-io/security/advisories/GHSA-9q7h-wgfw-p378 -

21 Apr 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-21 18:16

Updated : 2026-04-27 19:41

NVD link : CVE-2026-40608

Mitre link : CVE-2026-40608

CVE.ORG link : CVE-2026-40608

JSON object : View

Products Affected

dayuanjiang

  • next_ai_draw.io
CWE
CWE-770

Allocation of Resources Without Limits or Throttling