Zod denial of service vulnerability

Description

Zod version 3.22.2 allows an attacker to perform a denial of service while validating emails.

Recommendation

Update the zod package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.22.2
• Patched version(s): 3.22.3

References

• GHSA-m95q-7qp3-xv42
• www.npmjs.com
• fluidattacks.com
• CVE-2023-4316
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• ua-parser-js Regular Expression Denial of Service vulnerability - CVE-2020-7793
• angular vulnerable to regular expression denial of service via the <input type="url"> element - CVE-2023-26118
• angular vulnerable to regular expression denial of service via the $resource service - CVE-2023-26117
• angular vulnerable to regular expression denial of service via the angular.copy() utility - CVE-2023-26116

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

zod