Description
Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array, set or map to an application that uses a container schema without an explicit size constraint. The handleArrayResult parse logic in $ZodArray (and the equivalent set and map paths) accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate one issue object per element and crash under out-of-memory conditions. This is reachable in the default configuration whenever a container schema such as z.array() is declared without a size bound. The upstream change in commit e06a510 (pull request 6652, first released in 4.6.6) only moves the .max(), .length() and .size() size checks to run before element parsing, so it rejects oversized input for schemas that declare an explicit upper bound; per the maintainer, unbounded containers are unchanged. No released version remediates the unbounded (default) case described here, and an opt-in setting to cap total accumulated errors was proposed but not merged.
Published: 2026-10-01
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via memory exhaustion
Action: Apply Bounds
AI Analysis

Impact

The vulnerability resides in Zod’s handling of schema validation for containers. When a schema such as z.array() is declared without a size constraint, the parser accumulates a separate validation issue for every element that fails, without any cap or early termination. An attacker can exploit this by submitting an unbounded array, set, or map, causing the process to allocate an issue object per element and eventually crash due to out‑of‑memory conditions. This results in denial of service against the application.

Affected Systems

Based on the description, it is inferred that JavaScript and TypeScript projects importing the colinhacks Zod library are affected. Any usage of z.array(), z.set(), or z.map() without an explicit maximum bound is vulnerable, regardless of the library version, though the CVE data does not specify a particular version range.

Risk and Exploitability

The CVSS score of 8.2 classifies this as a high‑severity flaw. The EPSS score of < 1 % indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is sending oversized array‑like payloads to endpoints that perform Zod validation; no special privileges or authentication are required, making the flaw broadly exploitable for any unbounded schema.

Generated by OpenCVE AI on October 23, 2026 at 07:48 UTC.

Remediation

Vendor Solution

No released version fully remediates the unbounded (default) condition. Applications must add an explicit size bound, for example .max(n), to every array, set and map schema that validates untrusted input; from 4.6.6 (commit e06a510) such a declared bound is enforced before any element is parsed. Schemas left unbounded remain subject to unbounded issue accumulation and memory exhaustion. Audit all uses of z.array(), z.set() and z.map(), including those reached through third-party and transitive dependencies.

OpenCVE Recommended Actions

  • Add an explicit maximum length constraint (for example, .max(n), .length(n), or .size(n)) to every z.array(), z.set(), and z.map() that processes untrusted input before parsing begins.
  • Audit all instances of z.array(), z.set(), and z.map() across your codebase and transitive dependencies, refactoring any unbounded schemas to include bounds.
  • Upgrade to Zod 4.6.6 or later to benefit from reordered validation logic that rejects oversized input before element parsing, but continue to enforce explicit limits.
  • Implement application and infrastructure safeguards such as process memory quotas, request size caps, and rate limiting to reduce the impact of any remaining unbounded inputs.

Generated by OpenCVE AI on October 23, 2026 at 07:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions. Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array, set or map to an application that uses a container schema without an explicit size constraint. The handleArrayResult parse logic in $ZodArray (and the equivalent set and map paths) accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate one issue object per element and crash under out-of-memory conditions. This is reachable in the default configuration whenever a container schema such as z.array() is declared without a size bound. The upstream change in commit e06a510 (pull request 6652, first released in 4.6.6) only moves the .max(), .length() and .size() size checks to run before element parsing, so it rejects oversized input for schemas that declare an explicit upper bound; per the maintainer, unbounded containers are unchanged. No released version remediates the unbounded (default) case described here, and an opt-in setting to cap total accumulated errors was proposed but not merged.
Title Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation Zod Uncontrolled Resource Consumption via Unbounded Array, Set, and Map Validation
Weaknesses CWE-1188

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions. Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.
References

Tue, 06 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 01 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Zod
Zod zod
CPEs cpe:2.3:a:zod:zod:*:*:*:*:*:*:*:*
Vendors & Products Zod
Zod zod

Thu, 01 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Colinhacks
Colinhacks zod
Vendors & Products Colinhacks
Colinhacks zod

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.
Title Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Colinhacks Zod
Zod Zod
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-22T18:50:32.153Z

Reserved: 2026-10-01T17:10:41.641Z

Link: CVE-2023-54404

cve-icon Vulnrichment

Updated: 2026-10-06T01:56:43.944Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-01T18:17:11.040

Modified: 2026-10-22T19:17:32.020

Link: CVE-2023-54404

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-01T17:11:13Z

Links: CVE-2023-54404 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T08:00:17Z

Weaknesses
  • CWE-1188

    Initialization of a Resource with an Insecure Default

  • CWE-770

    Allocation of Resources Without Limits or Throttling