CVE-2026-40608Patch(dayuanjiang / next_ai_draw.io)

LOWCVSS 5.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch dayuanjiang next_ai_draw.io systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers (/api/state, /api/restore, and /api/history-svg) that process incoming requests by accumulating the entire request body into a JavaScript string without any size limitations. Node.js buffers the entire payload in the V8 heap. Sending a sufficiently large body (e.g., 500 MiB or more) will exhaust the process heap memory, leading to an Out-of-Memory (OOM) error that crashes the MCP server. This vulnerability is fixed in 0.4.15.

dayuanjiang CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/DayuanJiang/next-ai-draw-io/commit/31819f413cc4b329a1cb81e5fccd0cd98c1fd665

Exploit / PoC references

Weakness type (CWE)

CWE-770

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

next_ai_draw.io

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
General: 1 classified signal
Peaked 1d ago at 1 mentions (2026-04-19); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

dayuanjiang

Products

next_ai_draw.io

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Patch

150.0%

General

150.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-19	1	Patch1
2026-04-21	1	General1

Full discourse2 posts

Koukyosyumei@Koukyosyumei172d
Patch
Found an unbounded HTTP body vulnerability in next-ai-drawio’s MCP server. By sending a large POST payload, the server could exhaust memory and crash (OOM). Reported it, and it’s now fixed. CVE-2026-40608 assigned. Big thanks to the maintainers for the super-fast response Advisory: https://github.com/DayuanJiang/next-ai-draw-io/security/advisories/GHSA-9q7h-wgfw-p378
Post summary
The author discovered an OOM vulnerability in next-ai-drawio’s MCP server, reported it, and the issue has been fixed as documented in a GitHub advisory.
20020348
664 followersView on X
CVE@CVEnew170d
General
CVE-2026-40608 Next AI http://Draw.io is a next.js web application that integrates AI capabilities with http://draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST han… https://www.cve.org/CVERecord?id=CVE-2026-40608
Post summary
The tweet merely cites the CVE and references the affected component/version, providing no evidence of exploitation, PoC, patch, or detailed technical data.
00000142
57.2K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	dayuanjiang	next_ai_draw.io	-	-	-

Explore more

Back to dashboard dayuanjiang CVEs next_ai_draw.io vulnerabilities