Packages / zod / Security

HighVulnerabilityGHSA-mrhx-c7xc-m3w5CVE-2023-54404Published 1 Oct 2026

Zod can exhaust memory while validating oversized constrained collections

Affected releases · zod

  • 4.x4.0.0 – 4.6.5Fixed in 4.6.6
  • 3.x and older1.0.0 – 3.25.76No fix, no longer updated

On 4.x, the newest line:

npm install zod@4.6.6
4.x
  1. Affected

    4.0.0 – 4.6.5

    56 releases

  2. Fixed

    4.6.6 – 4.6.7

    2 releases, latest

3.x
  1. Affected

    3.0.0 – 3.25.76

    183 releases

1.x
  1. Affected

    1.0.0 – 1.11.17

    62 releases

303 stable releases of zod, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for zod. It is read in your browser and sent nowhere.

What happens

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.