Zod can exhaust memory while validating oversized constrained collections
Affected releases · zod
- 4.x4.0.0 – 4.6.5Fixed in 4.6.6
- 3.x and older1.0.0 – 3.25.76No fix, no longer updated
On 4.x, the newest line:
npm install zod@4.6.6Affected
4.0.0 – 4.6.5
56 releases
Fixed
4.6.6 – 4.6.7
2 releases, latest
Affected
3.0.0 – 3.25.76
183 releases
Affected
1.0.0 – 1.11.17
62 releases
Is your project affected?
Paste your package.json, or type the range you declare for zod. It is read in your browser and sent nowhere.
What happens
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.