zod
4.6.7 · 12 Oct 2026MIT207M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for zod. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 4.6.7 | No known advisory | |
| 3.25.76 | 1 open advisory, worst moderate · last release Jul 2025, no longer updated |
- ModerateZod denial of service vulnerabilityGHSA-m95q-7qp3-xv42 · 28 Sep 2023
- 3.x3.0.0 – 3.22.2Fixed in 3.22.3
- 1.x1.0.0 – 1.11.17No fix on 1.x · move to 3.22.3
Quality and security signals
What npm and deps.dev say about the latest release. Signals, not a verdict.
- Licence
- ProvenancePresent, built from github.com/colinhacks/zodSays where the release was built and from which commit. It does not say the code is safe.
- Published byGitHub Actions
- Maintainers on npm
- Size
- GitHub stars44,114 on colinhacks/zod
- Last release4.6.7, 12 October 2026
- OpenSSF Scorecard5.1 / 10 · 24 Aug 2026Lowest: CII-Best-Practices 0, Fuzzing 0, Pinned-Dependencies 0, SAST 0Grades the repository's practices (reviews, CI, branch protection), not the package's code.
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.