Memory Exhaustion Vulnerability in Next AI Draw.io Web Application

CVE-2026-40608

What is CVE-2026-40608?

The Next AI Draw.io web application, prior to version 0.4.15, is susceptible to a memory exhaustion vulnerability due to unbounded accumulation of request payloads in JavaScript string format. This occurs in the HTTP sidecar where three POST handlers process incoming requests without limiting the request body size. When excessively large payloads are sent, such as those around 500 MiB or more, the application experiences an Out-of-Memory (OOM) error, ultimately crashing the server. This critical scenario can disrupt service availability, requiring prompt action to update to version 0.4.15 where the issue is resolved.

References