{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54404", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-01T17:10:41.641Z", "datePublished": "2026-10-01T17:11:13.762Z", "dateUpdated": "2026-10-22T18:50:32.153Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T18:50:32.153Z" }, "title": "Zod Uncontrolled Resource Consumption via Unbounded Array, Set, and Map Validation", "descriptions": [ { "lang": "en", "value": "Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array, set or map to an application that uses a container schema without an explicit size constraint. The handleArrayResult parse logic in $ZodArray (and the equivalent set and map paths) accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate one issue object per element and crash under out-of-memory conditions. This is reachable in the default configuration whenever a container schema such as z.array() is declared without a size bound. The upstream change in commit e06a510 (pull request 6652, first released in 4.6.6) only moves the .max(), .length() and .size() size checks to run before element parsing, so it rejects oversized input for schemas that declare an explicit upper bound; per the maintainer, unbounded containers are unchanged. No released version remediates the unbounded (default) case described here, and an opt-in setting to cap total accumulated errors was proposed but not merged." } ], "tags": [ "x_open-source" ], "datePublic": "2023-01-12T00:00:00.000Z", "problemTypes": [ { "descriptions": [ { "lang": "en", "description": "Allocation of Resources Without Limits or Throttling", "cweId": "CWE-770", "type": "CWE" }, { "lang": "en", "description": "Initialization of a Resource with an Insecure Default", "cweId": "CWE-1188", "type": "CWE" } ] } ], "affected": [ { "defaultStatus": "affected", "vendor": "colinhacks", "product": "zod", "packageURL": "pkg:github/colinhacks/zod", "repo": "https://github.com/colinhacks/zod", "versions": [ { "status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.6.7" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:zod:zod:*:*:*:*:*:*:*:*" } ] } ] } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV4_0": { "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" } }, { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV3_1": { "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } } ], "references": [ { "url": "https://github.com/colinhacks/zod/issues/1872", "name": "Researcher Disclosure", "tags": [ "technical-description" ] }, { "url": "https://github.com/colinhacks/zod/pull/6475", "name": "Closed Pull Request", "tags": [ "issue-tracking" ] }, { "url": "https://github.com/colinhacks/zod/pull/6652", "tags": [ "issue-tracking", "patch" ], "name": "Merged Pull Request" }, { "url": "https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation", "tags": [ "third-party-advisory" ] } ], "credits": [ { "lang": "en", "value": "Axel Habermaier (axel-habermaier)", "type": "finder" }, { "lang": "en", "value": "Alessio Della Libera, CEO of Numyra", "type": "finder" } ], "solutions": [ { "lang": "en", "value": "No released version fully remediates the unbounded (default) condition. Applications must add an explicit size bound, for example .max(n), to every array, set and map schema that validates untrusted input; from 4.6.6 (commit e06a510) such a declared bound is enforced before any element is parsed. Schemas left unbounded remain subject to unbounded issue accumulation and memory exhaustion. Audit all uses of z.array(), z.set() and z.map(), including those reached through third-party and transitive dependencies." } ], "source": { "discovery": "UNKNOWN" }, "x_generator": { "engine": "vulncheck" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-10-06T01:56:37.688335Z", "id": "CVE-2023-54404", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-06T01:56:48.950Z" } } ] } }