Read the docs
TI-2023-30653 Aliases CVE-2023-54404GHSA-mrhx-c7xc-m3w5

Zod Uncontrolled Resource Consumption via Unbounded Array, Set, and Map Validation

Priority MEDIUM 42CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 15 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array, set or map to an application that uses a container schema without an explicit size constraint. The handleArrayResult parse logic in $ZodArray (and the equivalent set and map paths) accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate one issue object per element and crash under out-of-memory conditions. This is reachable in the default configuration whenever a container schema such as z.array() is declared without a size bound. The upstream change in commit e06a510 (pull request 6652, first released in 4.6.6) only moves the .max(), .length() and .size() size checks to run before element parsing, so it rejects oversized input for schemas that declare an explicit upper bound; per the maintainer, unbounded containers are unchanged. No released version remediates the unbounded (default) case described here, and an opt-in setting to cap total accumulated errors was proposed but not merged.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-10-28
Fix Partial zod (npm): 4.6.6Red Hat: 2 advisoriesRed Hat: 2 fixed, 15 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
colinhackszodup to 4.6.7—No fix listedCNA
—zod (npm)before 4.6.64.6.6Patch availableGHSA-mrhx-c7xc-m3w5
  • zod Vendorcolinhacks Affected up to 4.6.7 Fixed in — No fix listed CNA
  • zod (npm) Vendor— Affected before 4.6.6 Fixed in 4.6.6 Patch available GHSA-mrhx-c7xc-m3w5

Remediation

  • Fix · GHSA-mrhx-c7xc-m3w5 zod (npm) Fixed in 4.6.6 Advisory →

Red Hat 2 advisories

  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Ansible Automation Orchestrator 2026AffectedNo fix yet
Cost Management On PremiseAffectedNo fix yet
Migration Toolkit for Applications 8AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Build of KeycloakAffectedNo fix yet
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Developer Hub 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat Trusted Artifact SignerAffectedNo fix yet
Secrets Management Console for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Self-service automation portal 2AffectedNo fix yet
Red Hat OpenShift AI 3.4Fixed RHSA-2026:92510
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Not affected: 12 products
  • Cryostat 4
  • Red Hat Build of Podman Desktop
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.31

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-54404
  2. 2026-10-03 Alias added: GHSA-mrhx-c7xc-m3w5
  3. 2026-10-06 CISA SSVC decision points changed
  4. 2026-10-06 Priority changed: LOW → MEDIUM
  5. 2026-10-06 Affected versions changed · Red Hat
  6. 2026-10-08 Affected versions changed · Red Hat
  7. 2026-10-10 Affected versions changed · Red Hat
  8. 2026-10-13 Fix available: colinhacks/zod@e06a510b6fc1e6e28e3201fd116ca2a76212f6be · CNA
  9. 2026-10-13 1 new reference · CNA
  10. 2026-10-16 Affected versions changed · Red Hat
  11. 2026-10-22 Title updated · CNA
  12. 2026-10-22 Weakness changed · CNA
  13. 2026-10-22 Affected versions changed · CNA
  14. 2026-10-23 Fix available: npm/[email protected] · GHSA-mrhx-c7xc-m3w5
  15. 2026-10-23 CVSS score added · GHSA-mrhx-c7xc-m3w5
  16. 2026-10-23 Weakness changed · GHSA-mrhx-c7xc-m3w5
  17. 2026-10-23 6 new references · GHSA-mrhx-c7xc-m3w5
  18. 2026-10-27 Affected versions changed · Red Hat
  19. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  20. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
  21. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  22. 2026-10-30 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  23. 2026-10-30 Affected versions changed · Red Hat
  24. 2026-10-30 Affected versions changed · Red Hat
  25. 2026-11-05 Affected versions changed · Red Hat

References

Patch 1

Advisory 1

Other 4

  • TI-2026-06119 colinhacks Zod CUID Data Type regexes.ts sql injection CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences