Advisory · CVE-2023-54404
Zod's array validation could be drowned in its own error messages
Zod's array schema validation accumulated an unbounded number of per-element error objects with no cap or early exit, letting attackers exhaust server memory with a single large array.
- Vendor
- Zod
- Product
- Zod
- Identifier / CWE
- CVE-2023-54404
CWE-770 - Action timing
- Immediate
Explain it like I’m five
The teacher insisted on writing a full report card for every single wrong answer on a million-question test. The desk collapsed under the paperwork before the grading finished.
- 01Array schema exposed
An application validates attacker-supplied input with a Zod array schema that has no length constraint.
- 02Large array submitted
The attacker submits a very large array crafted so many elements fail validation.
- 03Issues pile up
The array parse logic accumulates a validation issue object for every failing element with no cap and no early termination.
- 04Memory exhausted
The process allocates excessive issue objects until it crashes from out-of-memory conditions, denying service.
What happened
CVE-2023-54404 describes an uncontrolled resource consumption flaw (CWE-770) in the Zod schema-validation library through version 4.6.5. When an application used an array schema without a length constraint, an attacker could submit a large array and exploit the array parse logic, which accumulated every validation issue for each failing element with no cap or early termination.
The process kept allocating issue objects until memory was exhausted and the application crashed. The vulnerability is network-exploitable with no privileges or user interaction required, rated high at CVSS 8.2. Zod is one of the most widely used validation libraries in the JavaScript and TypeScript ecosystem, so any service validating untrusted input with unconstrained array schemas is in scope.
What to do
- Upgrade to a Zod release containing the array-validation resource-consumption fix, referencing the upstream pull request for the corrected versions.
- Add explicit length constraints to array schemas that validate untrusted input, so oversized payloads are rejected before per-element validation.
- Enforce request and payload size limits at the application or gateway layer as defense in depth.
- Monitor services for memory spikes and crashes that could indicate probing.
Management note
Validation libraries sit on the hottest path in your stack: every request walks through them. A DoS bug here is a DoS bug everywhere the library is used, which for Zod is a very large everywhere. The upgrade is cheap; the schema audit is the real work.