CVE-2026-6991: colinhacks Zod CUID Data Type regexes.ts sql injection
A vulnerability was determined in colinhacks Zod up to 4.3.6. The impacted element is an unknown function of the file packages/zod/src/v4/core/regexes.ts of the component CUID Data Type Handler. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6991?
CVE-2026-6991 is considered to have a high severity due to its potential for SQL injection vulnerabilities.
How do I fix CVE-2026-6991?
To fix CVE-2026-6991, update the colinhacks Zod package to version 4.3.7 or later to address the SQL injection vulnerability.
Is CVE-2026-6991 exploitable in production environments?
Yes, CVE-2026-6991 is exploitable in production environments if vulnerable versions of the colinhacks Zod package are used.
What type of applications are affected by CVE-2026-6991?
Applications that utilize the colinhacks Zod package up to version 4.3.6 for data validation are affected by CVE-2026-6991.
What are the implications of CVE-2026-6991 for developers?
Developers using the affected versions of colinhacks Zod must prioritize patching to prevent potential SQL injection attacks.