2vulnerabilities
- Critical0 (0.0%)
- High1 (50.0%)
- Medium0 (0.0%)
- Moderate1 (50.0%)
- Low0 (0.0%)
zod
Ecosystem: npm
Downloads: 1.51 Bln
- 0CriticalAffects 0 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting zod, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | High | Zod can exhaust memory while validating oversized constrained collectionsZod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions. |
| GitHub (opens in a new tab) | |
| GHSA-m95q-7qp3-xv42 | Moderate | Zod denial of service vulnerabilityZod version 3.22.2 allows an attacker to perform a denial of service while validating emails. |
| GitHub (opens in a new tab) |
- GHSA-mrhx-c7xc-m3w5HighZod can exhaust memory while validating oversized constrained collections
< 4.6.6
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.
CVE: CVE-2023-54404
Zod version 3.22.2 allows an attacker to perform a denial of service while validating emails.
CVE: CVE-2023-4316