CVE-2023-54404: Zod Uncontrolled Resource Consumption via Unbounded Array, Set, and Map Validation
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.
Other sources
Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array, set or map to an application that uses a container schema without an explicit size constraint. The handleArrayResult parse logic in $ZodArray (and the equivalent set and map paths) accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate one issue object per element and crash under out-of-memory conditions. This is reachable in the default configuration whenever a container schema such as z.array() is declared without a size bound. The upstream change in commit e06a510 (pull request 6652, first released in 4.6.6) only moves the .max(), .length() and .size() size checks to run before element parsing, so it rejects oversized input for schemas that declare an explicit upper bound; per the maintainer, unbounded containers are unchanged. No released version remediates the unbounded (default) case described here, and an opt-in setting to cap total accumulated errors was proposed but not merged.
— OSV
Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zodto a version that resolves this vulnerability.Fixed in 4.6.6Patch e06a510 - Configuration
Declare an explicit size constraint before element parsing, using .max(), .length(), or .size() as appropriate; unbounded containers remain unchanged.
Zod array, set, and map schemas container size constraint = explicit upper bound
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using npm/zod through version 4.6.5 are exposed when they validate attacker-supplied arrays with an array schema that has no length constraint. The affected parsing path accumulates validation issues for every failing array element.
What does an attacker need to do to trigger the resource exhaustion?
An attacker can submit a sufficiently large array containing failing elements to a reachable validation endpoint or input path. No authentication or user interaction is required according to the supplied severity vector.
What can be done if updating is not immediately possible?
Add length constraints to array schemas that process untrusted input, and enforce request or payload size limits before Zod validation. These measures reduce the number of invalid elements for which issue objects can be accumulated.
How can I determine whether my application is affected?
Check whether the application depends on npm/zod version 4.6.5 or earlier and accepts untrusted arrays validated by unconstrained array schemas. Test or review paths where large arrays with invalid elements can reach Zod validation, as these are the inputs that can cause excessive issue-object allocation.