require-abort-signal

Ensures streaming calls have AbortSignal for graceful cancellation.

📊 Rule DetailsCopy Anchor Link

🔍 What This Rule DetectsCopy Anchor Link

This rule identifies streaming AI SDK calls (streamText, streamObject) that don't include an AbortSignal for cancellation.

❌ Incorrect CodeCopy Anchor Link

// No abort signal
await streamText({
  model: openai('gpt-4'),
  prompt: 'Stream a long response',
});

// Missing signal in streamObject
await streamObject({
  model: anthropic('claude-3'),
  prompt: 'Generate object',
  schema: mySchema,
});

✅ Correct CodeCopy Anchor Link

// With abort signal
const controller = new AbortController();
await streamText({
  model: openai('gpt-4'),
  prompt: 'Stream a long response',
  abortSignal: controller.signal,
});

// Using signal property
await streamObject({
  model: anthropic('claude-3'),
  prompt: 'Generate object',
  schema: mySchema,
  signal: abortController.signal,
});

⚙️ OptionsCopy Anchor Link

🛡️ Why This MattersCopy Anchor Link

Without abort signals:

• Resource leaks - Streams continue after user navigation
• Wasted costs - Tokens consumed after request cancelled
• Server overhead - Backend continues processing
• Poor UX - No way to cancel long operations

🔗 Related RulesCopy Anchor Link

• require-max-tokens - Limit token consumption
• require-error-handling - Handle errors

🔄 Changes in the 2026-10-10 FP/FN auditCopy Anchor Link

• A spread in the options may carry the signal and counts; SDK calls are matched by exact name.
• Now off in recommended: CVSS 4, and it fired on the SDK quickstart route.
• Options: the documented defaultOptions now apply. Earlier versions read context.options and silently ran a shorter hard-coded list instead.

Known False NegativesCopy Anchor Link

The following patterns are not detected due to static analysis limitations:

Signal from VariableCopy Anchor Link

Why: Signal stored in variables is not analyzed.

// ❌ NOT DETECTED - Signal from variable
const options = { signal: controller.signal };
await streamText({ model: openai('gpt-4'), ...options });

Mitigation: Use inline signal property.

Framework-Provided SignalCopy Anchor Link

Why: Framework signals are not visible.

// ❌ NOT DETECTED (correctly) - Next.js handles signals
export async function GET(req: Request) {
  // req.signal provided by Next.js
  return streamText({ ..., abortSignal: req.signal });
}

Mitigation: Document framework signal handling.

Wrapper FunctionsCopy Anchor Link

Why: Custom wrappers may include signal internally.

// ❌ NOT DETECTED - Wrapper adds signal
await myStreamText(prompt); // Wrapper adds signal internally

Mitigation: Apply rule to wrapper implementations.

📚 ReferencesCopy Anchor Link

• OWASP LLM10: Unbounded Consumption
• CWE-404: Improper Resource Shutdown
• Vercel AI SDK Streaming

Use this rule

npm install -D oxlint-plugin-vercel-ai-security

{  "jsPlugins": ["oxlint-plugin-vercel-ai-security"],  "rules": {    "vercel-ai-security/require-abort-signal": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-vercel-ai-security'],    rules: {      'vercel-ai-security/require-abort-signal': 'error',    },  },});