CVE-2023-54404: Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using npm/zod through version 4.6.5 are exposed when they validate attacker-supplied arrays with an array schema that has no length constraint. The affected parsing path accumulates validation issues for every failing array element.
What does an attacker need to do to trigger the resource exhaustion?
An attacker can submit a sufficiently large array containing failing elements to a reachable validation endpoint or input path. No authentication or user interaction is required according to the supplied severity vector.
What can be done if updating is not immediately possible?
Add length constraints to array schemas that process untrusted input, and enforce request or payload size limits before Zod validation. These measures reduce the number of invalid elements for which issue objects can be accumulated.
How can I determine whether my application is affected?
Check whether the application depends on npm/zod version 4.6.5 or earlier and accepts untrusted arrays validated by unconstrained array schemas. Test or review paths where large arrays with invalid elements can reach Zod validation, as these are the inputs that can cause excessive issue-object allocation.