CVE-2026-40608

CVE-2026-40608 is a Denial of Service vulnerability affecting Next AI Draw.io versions prior to 0.4.15. The flaw exists in three HTTP POST endpoints (/api/state, /api/restore, and /api/history-svg) within the embedded HTTP sidecar that fail to implement request body size limits, allowing attackers to send payloads exceeding 500 MiB to exhaust the Node.js process heap memory and crash the MCP server. The vulnerability is classified as MEDIUM severity (CVSS 6.2) with a local attack vector, low complexity, and no privileges required. The attack has no impact on confidentiality or integrity but causes high availability impact through process termination. The attack is straightforward to execute from the local system without user interaction. There is no evidence of active exploitation or public exploit code availability. The vulnerability appears to have minimal community attention, with an EPSS score of 0.00013 indicating very low real-world exploitation probability. The vulnerability is not on the Known Exploited Vulnerabilities (KEV) catalog and has been patched since version 0.4.15, making timely updates the primary mitigation strategy.