CVE-2026-40608: Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the…
Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers (/api/state, /api/restore, and /api/history-svg) that process incoming requests by accumulating the entire request body into a JavaScript string without any size limitations. Node.js buffers the entire payload in the V8 heap. Sending a sufficiently large body (e.g., 500 MiB or more) will exhaust the process heap memory, leading to an Out-of-Memory (OOM) error that crashes the MCP server. This vulnerability is fixed in 0.4.15.
- Published by source
- 2026-04-21
- First seen by Reality Radar
- 2026-10-27
- Last verified
- 2026-10-27
Affected
- Manufacturer
- dayuanjiang
- Products
- next ai draw.io
- Versions
- <0.4.15
- CPE
- cpe:2.3:a:dayuanjiang:next_ai_draw.io:*:*:*:*:*:*:*:*
Whether your exact unit is affected depends on the model, serial number and region in the official notice.
What the official notice says
Risk: CVSS 6.2
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-04-21
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #2148 | new | 2026-10-27 | 5266dd1c28d1…142c32 | a194e9c8bb1a…2efe0c |
Chain head: #2286 e212558e872c…954bc1