Packages / zod / Security

ModerateVulnerabilityGHSA-m95q-7qp3-xv42CVE-2023-4316Published 28 Sep 2023

Zod denial of service vulnerability

Affected releases · zod

  • 3.x3.0.0 – 3.22.2Fixed in 3.22.3
  • 1.x1.0.0 – 1.11.17No fix on this line yet

On 3.x, the newest line:

npm install zod@3.22.3
4.x

  1. Not affected

    4.0.0 – 4.6.7

    58 releases, latest

3.x

  1. Affected

    3.0.0 – 3.22.2

    91 releases

  2. Fixed

    3.22.3 – 3.25.76

    92 releases

1.x

  1. Affected

    1.0.0 – 1.11.17

    62 releases

303 stable releases of zod, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for zod. It is read in your browser and sent nowhere.

What happens

Zod version 3.22.2 allows an attacker to perform a denial of service while validating emails.