GHSA-mrhx-c7xc-m3w5

    Dashboard / Vulnerabilities / GHSA-mrhx-c7xc-m3w5

    GHSA-mrhx-c7xc-m3w5

    Published: 1 Oct 2026Last Modified: 23 Oct 2026

    Summary: Zod can exhaust memory while validating oversized constrained collections

    Details: Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.

    References: https://nvd.nist.gov/vuln/detail/CVE-2023-54404, https://github.com/colinhacks/zod/issues/1872, https://github.com/colinhacks/zod/pull/6475, https://github.com/colinhacks/zod/pull/6652, https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd, https://github.com/colinhacks/zod, https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation

    Affected packages

    Package

    Name: zod

    Purl: pkg:npm/zod

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -4.6.6

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High