CVE-2023-54404GHSA-mrhx-c7xc-m3w5
Zod can exhaust memory while validating oversized constrained collections
colinhacks zodnpmLibraries & packages
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.6.6zod, npmGitHub
npm install zod@4.6.6
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.
Text from CVE List
Affected versions 3
- zod, npm< 4.6.6GitHub
- zodaffected: all versions through 4.6.7CVE List
- zod, npmfrom first release, fixed in 4.6.6OSV
References 7
- github.com/colinhacks/zod/pull/6652Fixvia CVE List
- github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bdFixvia GitHub
- vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validationAdvisoryvia CVE List
- github.com/advisories/GHSA-mrhx-c7xc-m3w5Advisoryvia GitHub
- nvd.nist.gov/vuln/detail/CVE-2023-54404Referencevia GitHub
- github.com/colinhacks/zod/issues/1872Referencevia CVE List
- github.com/colinhacks/zod/pull/6475Referencevia CVE List