CVE-2023-4316

Zod 3.22.2 - Regular expression Denial of Service

7.5 HighFix available

Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.92%Up 0.9 points since Sep 29, 2023

What each source reports

CVE List Score used 7.5

Zod 3.22.2 - Regular expression Denial of Service

Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.

Record: CVE-2023-4316
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-1333
Updated: 2026-11-02

EUVDEUVD-2023-2547 7.5

Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.

Record: EUVD-2023-2547
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-m95q-7qp3-xv42 5.3

Zod denial of service vulnerability

Zod version 3.22.2 allows an attacker to perform a denial of service while validating emails.

Record: GHSA-m95q-7qp3-xv42
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-1333
Updated: 2026-11-02

NVD 7.5

Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.

Record: CVE-2023-4316
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-1333
Updated: 2026-11-02

OSV 7.5

Zod 3.22.2 - Regular expression Denial of Service

Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails.

Record: CVE-2023-4316
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-1333
Updated: 2026-11-02

OSVGHSA-m95q-7qp3-xv42 5.3

Zod denial of service vulnerability

Zod version 3.22.2 allows an attacker to perform a denial of service while validating emails.

Record: GHSA-m95q-7qp3-xv42
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-1333
Updated: 2026-11-02

OSVCLSA-2026-1782867616 No score

TuxCare security update for zod (1 CVE)

TuxCare rebuilt zod to address 1 CVE. Fixed in 3.21.4-tuxcare.1.

Record: CLSA-2026-1782867616
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`zod` npm	through 3.22.2	3.22.3
`zod` TuxCare:npm	3.21.4-tuxcare.0 up to 3.21.4-tuxcare.1, plus listed versions 3.21.4	3.21.4-tuxcare.1
`zod` npm	before 3.22.3	3.22.3

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-4316 is a high vulnerability (CVSS 7.5) in Colinhacks Zod, published September 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in zod 3.22.3.

References

Show 5 moreShow less