Description
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint.
Recommendation
Update the zod package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.6.6
- Patched version(s): 4.6.6
References
Could your website be exposed too?
SmartScanner can check your website for Zod can exhaust memory while validating oversized constrained collections and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Hidden fields can be leaked on readable collections in Payload - CVE-2023-30843
- matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms - CVE-2023-38700
- msgpackr's conversion of property names to strings can trigger infinite recursion - CVE-2023-52079
- Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) - CVE-2023-25653
You might also like:
See something that needs correcting? Let us knowUpdated October 23, 2026