CVE-2026-40608 Details

A denial-of-service vulnerability has been identified in Next AI Draw.io versions prior to 0.4.15. The issue arises in the embedded HTTP sidecar, which contains three POST handlers that process incoming requests by accumulating the entire request body into a JavaScript string without any size limitations. This unbounded accumulation allows for the possibility of sending excessively large payloads, such as 500 MiB or more, which can exhaust the process heap memory. The result is an Out-of-Memory error that crashes the MCP server, disrupting active user sessions and causing the loss of unsaved diagram states.

Users can update to Next AI Draw.io version 0.4.15 or later, where this vulnerability has been fixed. For those using the MCP server, it's recommended to enforce a maximum body size limit in each POST handler before processing the request. This can be done by replacing the existing body accumulation logic with a version that checks the payload size and responds with a 413 status code if the limit is exceeded.