CVE-2023-4316 - Vulnerability Details - OpenCVE

Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00144.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Zod	Zod

Configuration 1 [-]

cpe:2.3:a:zod:zod:3.22.2:*:*:*:*:node.js:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-2547	Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.
Github GHSA	GHSA-m95q-7qp3-xv42	Zod denial of service vulnerability

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://fluidattacks.com/advisories/swift
https://www.npmjs.com/package/zod

History

Wed, 18 Jun 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 05 Sep 2024 22:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20

Thu, 05 Sep 2024 22:15:00 +0000

Type	Values Removed	Values Added
Description	Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.	Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.

MITRE

Status: PUBLISHED

Assigner: Fluid Attacks

Published: 2023-09-28T20:34:09.161Z

Updated: 2025-06-18T14:07:41.023Z

Reserved: 2023-08-11T21:45:12.813Z

Link: CVE-2023-4316

Vulnrichment

Updated: 2024-08-02T07:24:03.676Z

NVD

Status : Modified

Published: 2023-09-28T21:15:10.313

Modified: 2024-11-21T08:34:50.513

Link: CVE-2023-4316

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-4316", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "state": "PUBLISHED", "assignerShortName": "Fluid Attacks", "dateReserved": "2023-08-11T21:45:12.813Z", "datePublished": "2023-09-28T20:34:09.161Z", "dateUpdated": "2025-06-18T14:07:41.023Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Zod", "vendor": "Zod", "versions": [{"lessThanOrEqual": "3.22.3", "status": "affected", "version": "3.21.0", "versionType": "custom"}]}], "datePublic": "2023-09-28T20:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div>Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.</div></div>"}], "value": "Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails."}], "impacts": [{"capecId": "CAPEC-492", "descriptions": [{"lang": "en", "value": "CAPEC-492 Regular Expression Exponential Blowup"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "description": "CWE-1333 Inefficient Regular Expression Complexity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2024-09-05T21:58:23.755Z"}, "references": [{"url": "https://fluidattacks.com/advisories/swift"}, {"url": "https://www.npmjs.com/package/zod"}], "source": {"discovery": "EXTERNAL"}, "title": "Zod 3.22.2 - Regular expression Denial of Service", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:24:03.676Z"}, "title": "CVE Program Container", "references": [{"url": "https://fluidattacks.com/advisories/swift", "tags": ["x_transferred"]}, {"url": "https://www.npmjs.com/package/zod", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-04T17:16:46.779146Z", "id": "CVE-2023-4316", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-18T14:07:41.023Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://fluidattacks.com/advisories/swift", "tags": ["x_transferred"]}, {"url": "https://www.npmjs.com/package/zod", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:24:03.676Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-4316", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-04T17:16:46.779146Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-18T14:07:37.760Z"}}], "cna": {"title": "Zod 3.22.2 - Regular expression Denial of Service", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-492", "descriptions": [{"lang": "en", "value": "CAPEC-492 Regular Expression Exponential Blowup"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zod", "product": "Zod", "versions": [{"status": "affected", "version": "3.21.0", "versionType": "custom", "lessThanOrEqual": "3.22.3"}], "defaultStatus": "unaffected"}], "datePublic": "2023-09-28T20:30:00.000Z", "references": [{"url": "https://fluidattacks.com/advisories/swift"}, {"url": "https://www.npmjs.com/package/zod"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.", "supportingMedia": [{"type": "text/html", "value": "<div><div>Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.</div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333 Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks", "dateUpdated": "2024-09-05T21:58:23.755Z"}}}, "cveMetadata": {"cveId": "CVE-2023-4316", "state": "PUBLISHED", "dateUpdated": "2025-06-18T14:07:41.023Z", "dateReserved": "2023-08-11T21:45:12.813Z", "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "datePublished": "2023-09-28T20:34:09.161Z", "assignerShortName": "Fluid Attacks"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zod:zod:3.22.2:*:*:*:*:node.js:*:*", "matchCriteriaId": "4BE54383-C209-4101-B3EA-BC832CDAD214", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails."}, {"lang": "es", "value": "Zod en su versi\u00f3n 3.22.2 permite a un atacante realizar una denegaci\u00f3n de servicio mientras valida correos electr\u00f3nicos"}], "id": "CVE-2023-4316", "lastModified": "2024-11-21T08:34:50.513", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "help@fluidattacks.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-28T21:15:10.313", "references": [{"source": "help@fluidattacks.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://fluidattacks.com/advisories/swift"}, {"source": "help@fluidattacks.com", "tags": ["Product"], "url": "https://www.npmjs.com/package/zod"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://fluidattacks.com/advisories/swift"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://www.npmjs.com/package/zod"}], "sourceIdentifier": "help@fluidattacks.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "help@fluidattacks.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-1333"}], "source": "nvd@nist.gov", "type": "Secondary"}]}