Skip to content

Backport: fix/unbounded download dos (#12445)#12509

Merged
gr2m merged 1 commit intorelease-v5.0from
backport-12445
Feb 12, 2026
Merged

Backport: fix/unbounded download dos (#12445)#12509
gr2m merged 1 commit intorelease-v5.0from
backport-12445

Conversation

@gr2m
Copy link
Copy Markdown
Collaborator

@gr2m gr2m commented Feb 12, 2026

Summary

  • Backport of fix/unbounded download dos #12445 to release-v5.0
  • Adds size-limited download via readResponseWithSizeLimit to prevent unbounded memory consumption (DoS)
  • Adds maxBytes and abortSignal parameters to download functions
  • Skipped generate-video and download-blob changes (files don't exist on v5.0)

Test plan

  • Test changes against local POC

- Replace unbounded `arrayBuffer()`/`blob()` calls in `download()` and
`downloadBlob()` with streaming reads that enforce a **2 GiB default
size limit**
- Add `abortSignal` passthrough from callers (`transcribe`,
`generateVideo`) to `fetch()`
- Check `Content-Length` header for early rejection before reading body
- Track bytes incrementally via `ReadableStream.getReader()`, abort with
`DownloadError` when limit exceeded
- Expose configurable `download` parameter on `transcribe()` and
`experimental_generateVideo()` (instead of adding a new
`maxDownloadSize` argument) — keeps download config separate from API
function signatures
- Export `createDownload({ maxBytes })` factory from `ai` for custom
size limits

closes #9481 / addresses
#9481 (comment)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
@vercel-ai-sdk vercel-ai-sdk bot added the maintenance CI, internal documentation, automations, etc label Feb 12, 2026
@gr2m gr2m merged commit 20565b8 into release-v5.0 Feb 12, 2026
29 checks passed
@gr2m gr2m deleted the backport-12445 branch February 12, 2026 22:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

maintenance CI, internal documentation, automations, etc

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant