zod

4.6.7MIT

4.6.7 is the latest, published 12 October 2026.
1 security advisory, all fixed.
4.x: 58 releases since 9 July 2025, 13 in the last 90 days.

Security advisories

Grouped by the version that fixes them, so one upgrade reads as one step.

Fixed in 3.22.3 · 1 advisory
- MODERATEZod denial of service vulnerabilityGHSA-m95q-7qp3-xv42

Releases in the last 90 days

Feed of releases and advisories

Every stable release, newest first. Notes are quoted as the maintainers published them.

4.6.7
12 October 2026
4.6.6
11 October 2026
types: declare record output and input as members, not base type arguments
Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.
Commits
- fix(types): declare record output and input as members, not base type arguments
- fix(v4): check array, set and map size bounds before parsing elements
4.6.5
13 September 2026
instanceof: key the .properties() shape off the instance type
Commits
- feat(instanceof): key the .properties() shape off the instance type
- Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
- Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
4.6.4
13 September 2026
A patch on top of 4.6.3.
A patch on top of 4.6.3.
- feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI
- perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path
4.6.3
12 September 2026
A patch on top of 4.6.2.
A patch on top of 4.6.2.
- fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
4.6.2
10 September 2026
A patch on top of 4.6.1.
A patch on top of 4.6.1.
- fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
4.6.1
9 September 2026
A patch on top of 4.6.0.
A patch on top of 4.6.0.
- fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
- fix(v4): defer recursive object index inference
- feat(lang): add Tajik (tg) locale
4.6.0
9 September 2026
Zod 4.6 is now available.
Zod 4.6 is now available.
```
npm install zod@latest
```
At a glance:
- .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
- z.instanceof().properties() — validates properties of an instance
- fromJSONSchema() — enforces six validation keywords it used to ignore
- z.iban() — electronic-format IBAN plus mod-97 checksum
- z.withParser() — installs a parser generated elsewhere, for environments without new Function
- Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
- Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
- @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5
.validate()
Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.
```
z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false
```
It is a method on Zod Classic schemas too.
```
const Player = z.object({
  username: z.string(),
  xp: z.number(),
});

if (Player.validate(data)) {
  data.username; // narrowed
}
```
In conjunction with z.compile(), this can be up to 35x faster than .safeParse().success on invalid input.
Time per call on invalid input, schemas compiled with z.compile(), safeParse().success as a gray bar with .validate() as a blue bar inside it: a union of 3 objects 28 ns (34.9x faster), an array of 10 strings 23 ns (24.6x), a 3-element tuple 28 ns (16.1x), a 5-key object 21 ns (16.3x), a discriminated union of 3 21 ns (15.7x), z.number() 19 ns (13.8x), z.string() 19 ns (13.2x), z.boolean() 19 ns (13.7x); up to 34.9x faster
Time per call on invalid input, compiled with z.compile() — lower is better (benchmark)
Uncompiled schemas
Without compilation it is up to 5.9x faster. The saving is the result object: .safeParse() allocates one with an accessor pair on every call, and .validate() allocates nothing.
Time per call on invalid input, plain schemas, safeParse().success as a gray bar with .validate() as a blue bar inside it: a union of 3 objects 659 ns (1.5x faster), an array of 10 strings 211 ns (2.3x), a 3-element tuple 166 ns (2.5x), a discriminated union of 3 93 ns (3.3x), a 5-key object 75 ns (3.9x), z.number() 47 ns (5.3x), z.string() 42 ns (5.8x), z.boolean() 42 ns (5.9x); up to 5.9x faster
Time per call on invalid input, plain schemas — lower is better (benchmark)
Both charts measure the failure path. The key feature of .validate() is that it can short-circuit on the first issue it encounters, instead of aggregating a full ZodIssue[] array.
[!NOTE] Async refinements are covered by .validateAsync().
z.properties()
A new API for validating specific properties of an object. Unlike z.object() it validates in-place, so it plays nice with class instances.
```
const responseLike = z.properties({ status: z.number().min(200).max(299) });

responseLike.parse(new Response("ok", { status: 200 }));  // ✅ a real Response
responseLike.parse({ status: 204 });                      // ✅ a plain object
```
A corresponding .properties() method has been added to ZodInstanceOf.
Zod
4.5.4
29 August 2026
v4: stop the cycle walk from firing a default factory
Commits
- fix(v4): stop the cycle walk from firing a default factory
4.5.3
29 August 2026
docs: drop the OG description when the title wraps past two lines
Commits
- fix(docs): drop the OG description when the title wraps past two lines
- bench(v4): z.compile() against zod-compiler
- fix(v4): emit record numeric keys as strings in toJSONSchema

Show 3 earlier releases

4.5.2
29 August 2026
docs: keep blog posts out of the docs collection
Commits
- fix(docs): keep blog posts out of the docs collection
- fix(v4): let a prototype method getter answer a bare call so vi.spyOn works
- fix(docs): match the blog TOC hover bar to the 2px active indicator
- fix(docs): drop ISR on the docs route so the home page hydrates
- fix(docs): render blog tabs with the stock fumadocs tab card
4.5.0
28 August 2026
Zod 4.5 is now available.
Zod 4.5 is now available.
```
npm install zod@latest
```
At a glance:
- z.compile() — the flagship feature of Zod 4.5
- z.creditCard() — 12–19 digits plus Luhn checksum
- z.properties() — the multi-property counterpart to z.property()
- z.deepPartial()/.exactPartial()
- z.validate(): boolean — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
- 9x reduction in memory footprint
- New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)
z.compile()
You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.
```
import * as z from "zod";

const Player = z.object({
  username: z.string(),
  bio: z.string(),
  xp: z.number(),
  // ...20 more properties...
});

const CompiledPlayer = z.compile(Player);
```
A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.
```
Player.parse({ ... });
CompiledPlayer.parse({ ... }); // ~9x faster
```
On objects, arrays, and unions, this speeds up parsing by a factor of ~3–9. More complex schemas stand to benefit more than simpler ones.
Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)
Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.
Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)
And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).
Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)
Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.
How it works
Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.
Take this simple Point schema:
```
const Point = z.object({
  x: z.number(),
  y: z.number()
});
```
Here is the generated snippet for it:
```
const isPoint = new Function("input", `
  if (typeof input !== "object" || input === null) return false;
  if (typeof input.x !== "number") return false;
  if (typeof input.y !== "number") return false;
  return true;
`);

isPoint({ x: 1, y: 2 }); // true
isPoint({ x: "1" });     // false
```
For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.
This is the function Zod generates for the Player schema above:
4.5.1
28 August 2026
Release notes

All 303 releases

Major versions

4.xsince 9 July 2025 · latest 4.6.7 · 58 releases
3.xsince 17 May 2021 · latest 3.25.76 · 183 releases
1.xsince 7 March 2020 · latest 1.11.17 · 62 releases

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 15 October 2026. Releases and advisories last read 15 October 2026.

Know when your own dependencies move

Inlinr tracks your coding time automatically. Switch dependency tracking on for a project and it reads that repository's manifest to show what is behind and what has been deprecated — off by default, one project at a time.

See what Inlinr does All packages

Security advisories

Releases in the last 90 days

4.6.7

4.6.6

4.6.5

4.6.4

4.6.3

4.6.2

4.6.1

4.6.0

4.5.4

4.5.3

4.5.2

4.5.0

4.5.1

Major versions

Quality and security signals

Know when your own dependencies move