The flaw allows an attacker to send arbitrarily large POST request bodies to the /api/state, /api/restore and /api/history-svg endpoints of Next AI Draw.io. The application concatenates the entire request payload into a JavaScript string without any size check, causing Node.js to allocate the full size in the V8 heap. A request of roughly 500 MiB or more exhausts the process memory and triggers an Out‑of‑Memory error that crashes the service. This is a resource exhaustion vulnerability (CWE‑770).

The vulnerability affects the Next AI Draw.io web application version 0.4.14 and earlier, hosted by the vendor DayuanJiang. Attackers can target the web service at any exposed instance of the application, specifically the three POST endpoints mentioned above.

The CVSS score of 6.2 denotes a moderate severity and the absence of an EPSS score indicates no publicly known exploitation frequency. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring only that an attacker can reach the HTTP endpoints; no authentication or local execution is needed. A successful exploitation results in a denial of service for all users of the affected instance and could potentially create a DoS cascade if multiple instances share resources.