This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size lim…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2023-54404 · Microsoft / collected KEV context

EUVD-2023-60702

GHSA-mrhx-c7xc-m3w5

cve-program · CVE-2023-54404

euvd · EUVD-2023-60702

nvd · CVE-2023-54404

osv · GHSA-mrhx-c7xc-m3w5

• https://nvd.nist.gov/vuln/detail/CVE-2023-54404
• https://github.com/colinhacks/zod/issues/1872
• https://github.com/colinhacks/zod/pull/6475
• https://github.com/colinhacks/zod/pull/6652
• https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd
• https://github.com/colinhacks/zod
• https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation

• This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size lim… · Advisory content revised · 31 Oct 2026
• This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size lim… · Advisory content revised · 29 Oct 2026
• Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application… · Source marks advisory rejected · 29 Oct 2026
• This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size lim… · Source marks advisory rejected · 28 Oct 2026