AI SDK fixes memory exhaustion when validating malformed UI messages (November 12, 2026)

What changed

November 12, 2026: ai@7.0.171 and ai@6.0.331 fix a way for a small request to exhaust server memory. ai@5.0.290 got the same fix on November 13, 2026.

Before, validateUIMessages, safeValidateUIMessages and (on the 7 and 6 lines) the agent UI stream helpers reported the issues of every part schema for every invalid part. A small request with many malformed parts could use up memory and CPU. Now each part is checked only against the schemas for its own type, validation stops at the first invalid message or part, and a bad JSON value in provider or tool metadata is reported as one issue.

Prerequisites

An app that validates chat messages sent from the browser with validateUIMessages, safeValidateUIMessages or the agent UI stream helpers
No new key: your model key (for example AI_GATEWAY_API_KEY) stays as it is

Steps

Upgrade ai: npm install ai@7.0.173 on AI SDK 7, npm install ai@6.0.332 on AI SDK 6, or npm install ai@5.0.290 on AI SDK 5.
Keep validating incoming messages as before. The docs' basic usage:

TypeScript

import { validateUIMessages } from 'ai';

const messages = [
  {
    id: '1',
    role: 'user',
    parts: [{ type: 'text', text: 'Hello!' }],
  },
];

const validatedMessages = await validateUIMessages({
  messages,
});

Test it

Send one normal chat message through your route and check it still validates. Then send a request with many broken parts: it should fail quickly with a validation error instead of slowing the server.

Not confirmed

Vercel published no GitHub security advisory or CVE for this, and the release notes do not say which earlier versions were affected.
The release notes do not say whether useChat routes that never call these functions were affected.