{"id":"CVE-2023-54404","aliases":["CLSA-2026-1793221263","CLSA-2026-1793221310","CLSA-2026-1793241442","CLSA-2026-1793241599","CLSA-2026-1793241749","EUVD-2023-60702","GHSA-mrhx-c7xc-m3w5","ROOT-APP-NPM-CVE-2023-54404"],"status":"rejected","title":"Zod can exhaust memory while validating oversized constrained collections","description":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1188","CWE-770"],"published":"2026-10-01T17:11:13Z","modified":"2026-10-30T19:46:06Z","fixes":[{"ecosystem":"npm","package":"zod","fixed_in":["4.6.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"zod","fixed_in":["3.25.76-tuxcare.2","3.21.4-tuxcare.2","3.25.48-tuxcare.1","3.25.75-tuxcare.1","3.25.67-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"zod","fixed_in":["3.25.67-aikido.1","3.24.4-aikido.1","3.22.4-aikido.1","3.22.3-aikido.1","3.24.2-aikido.1","3.23.8-aikido.1","3.25.76-aikido.2","3.24.1-aikido.1","3.21.4-aikido.1","3.22.3-aikido.2","3.25.58-aikido.1","3.24.3-aikido.1","4.5.4-aikido.1","4.5.0-aikido.1","4.6.0-aikido.1","4.6.5-aikido.1","4.4.0-aikido.1","4.3.6-aikido.1","4.1.12-aikido.1","4.4.3-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/zod","fixed_in":["3.25.67-root.io.1","3.24.4-root.io.1","3.22.4-root.io.1","3.22.3-root.io.1","3.24.2-root.io.1","3.23.8-root.io.1","3.25.76-root.io.2","3.24.1-root.io.1","3.21.4-root.io.1","3.22.3-root.io.2","3.25.58-root.io.1","3.24.3-root.io.1","4.5.4-root.io.1","4.5.0-root.io.1","4.6.0-root.io.1","4.6.5-root.io.1","4.4.0-root.io.1","4.3.6-root.io.1","4.1.12-root.io.1","4.4.3-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"zod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"zod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.25.76-tuxcare.0"},{"fixed":"3.25.76-tuxcare.2"}]}],"versions":["3.25.76","3.25.76-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"zod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.21.4-tuxcare.0"},{"fixed":"3.21.4-tuxcare.2"}]}],"versions":["3.21.4","3.21.4-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"zod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.25.48-tuxcare.0"},{"fixed":"3.25.48-tuxcare.1"}]}],"versions":["3.25.48"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"zod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.25.75-tuxcare.0"},{"fixed":"3.25.75-tuxcare.1"}]}],"versions":["3.25.75"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"zod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.25.67-tuxcare.0"},{"fixed":"3.25.67-tuxcare.1"}]}],"versions":["3.25.67"]},{"source":"osv","ecosystem":"npm","package":"zod","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.6.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"zod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.25.67-aikido.1"},{"fixed":"3.24.4-aikido.1"},{"fixed":"3.22.4-aikido.1"},{"fixed":"3.22.3-aikido.1"},{"fixed":"3.24.2-aikido.1"},{"fixed":"3.23.8-aikido.1"},{"fixed":"3.25.76-aikido.2"},{"fixed":"3.24.1-aikido.1"},{"fixed":"3.21.4-aikido.1"},{"fixed":"3.22.3-aikido.2"},{"fixed":"3.25.58-aikido.1"},{"fixed":"3.24.3-aikido.1"},{"fixed":"4.5.4-aikido.1"},{"fixed":"4.5.0-aikido.1"},{"fixed":"4.6.0-aikido.1"},{"fixed":"4.6.5-aikido.1"},{"fixed":"4.4.0-aikido.1"},{"fixed":"4.3.6-aikido.1"},{"fixed":"4.1.12-aikido.1"},{"fixed":"4.4.3-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/zod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.25.67-root.io.1"},{"fixed":"3.24.4-root.io.1"},{"fixed":"3.22.4-root.io.1"},{"fixed":"3.22.3-root.io.1"},{"fixed":"3.24.2-root.io.1"},{"fixed":"3.23.8-root.io.1"},{"fixed":"3.25.76-root.io.2"},{"fixed":"3.24.1-root.io.1"},{"fixed":"3.21.4-root.io.1"},{"fixed":"3.22.3-root.io.2"},{"fixed":"3.25.58-root.io.1"},{"fixed":"3.24.3-root.io.1"},{"fixed":"4.5.4-root.io.1"},{"fixed":"4.5.0-root.io.1"},{"fixed":"4.6.0-root.io.1"},{"fixed":"4.6.5-root.io.1"},{"fixed":"4.4.0-root.io.1"},{"fixed":"4.3.6-root.io.1"},{"fixed":"4.1.12-root.io.1"},{"fixed":"4.4.3-root.io.1"}]}]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","tags":["advisory"]},{"url":"https://github.com/colinhacks/zod/issues/1872","tags":["article","web"]},{"url":"https://github.com/colinhacks/zod/pull/6475","tags":["report","web"]},{"url":"https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","tags":["advisory","web"]},{"url":"https://github.com/colinhacks/zod/pull/6652","tags":["fix","web"]},{"url":"https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54404.json","tags":["advisory"]},{"url":"https://github.com/colinhacks/zod","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-54404","description":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.","status":"rejected","published":"2026-10-01T17:11:13.762Z","modified":"2026-10-28T21:17:22.423Z","updated_at":"2026-11-02T14:35:15.066338Z"}],"euvd":[{"id":"EUVD-2023-60702","description":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.","status":"published","published":"2026-10-01T17:11:13Z","modified":"2026-10-28T21:17:22Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:18.489561Z"}],"ghsa":[{"id":"GHSA-mrhx-c7xc-m3w5","title":"Zod can exhaust memory while validating oversized constrained collections","description":"Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.","status":"published","published":"2026-10-01T18:32:46Z","modified":"2026-10-23T18:26:52Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:41:35.723785Z"}],"nvd":[{"id":"CVE-2023-54404","description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.","status":"rejected","published":"2026-10-01T18:17:11.04Z","modified":"2026-10-28T22:17:10.417Z","updated_at":"2026-11-02T14:09:27.733183Z"}],"osv":[{"id":"CVE-2023-54404","title":"Zod Uncontrolled Resource Consumption via Unbounded Array, Set, and Map Validation","description":"Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array, set or map to an application that uses a container schema without an explicit size constraint. The handleArrayResult parse logic in $ZodArray (and the equivalent set and map paths) accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate one issue object per element and crash under out-of-memory conditions. This is reachable in the default configuration whenever a container schema such as z.array() is declared without a size bound. The upstream change in commit e06a510 (pull request 6652, first released in 4.6.6) only moves the .max(), .length() and .size() size checks to run before element parsing, so it rejects oversized input for schemas that declare an explicit upper bound; per the maintainer, unbounded containers are unchanged. No released version remediates the unbounded (default) case described here, and an opt-in setting to cap total accumulated errors was proposed but not merged.","status":"published","published":"2026-10-01T17:11:13.762Z","modified":"2026-10-29T02:47:44.831615881Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1188","CWE-770"],"updated_at":"2026-11-02T15:44:36.851042Z"},{"id":"GHSA-mrhx-c7xc-m3w5","title":"Zod can exhaust memory while validating oversized constrained collections","description":"Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.","status":"published","published":"2026-10-01T18:32:46Z","modified":"2026-10-23T18:30:09.376405885Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"CLSA-2026-1793221263","title":"TuxCare security update for zod (1 CVE)","description":"TuxCare rebuilt zod to address 1 CVE. Fixed in 3.25.76-tuxcare.2.","status":"published","published":"2026-10-28T21:01:03Z","modified":"2026-10-30T19:46:06.403545475Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793221310","title":"TuxCare security update for zod (1 CVE)","description":"TuxCare rebuilt zod to address 1 CVE. Fixed in 3.21.4-tuxcare.2.","status":"published","published":"2026-10-28T21:01:50Z","modified":"2026-10-29T02:15:02.469349129Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793241442","title":"TuxCare security update for zod (1 CVE)","description":"TuxCare rebuilt zod to address 1 CVE. Fixed in 3.25.48-tuxcare.1.","status":"published","published":"2026-10-29T02:37:22Z","modified":"2026-10-29T08:00:03.595803792Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793241599","title":"TuxCare security update for zod (1 CVE)","description":"TuxCare rebuilt zod to address 1 CVE. Fixed in 3.25.75-tuxcare.1.","status":"published","published":"2026-10-29T02:39:59Z","modified":"2026-10-29T08:00:03.582735801Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793241749","title":"TuxCare security update for zod (1 CVE)","description":"TuxCare rebuilt zod to address 1 CVE. Fixed in 3.25.67-tuxcare.1.","status":"published","published":"2026-10-29T02:42:29Z","modified":"2026-10-29T08:00:03.580480049Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"ROOT-APP-NPM-CVE-2023-54404","title":"CVE-2023-54404 in zod - Patched by Root","description":"Root has patched CVE-2023-54404 in the zod package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-30T09:38:41Z","modified":"2026-10-30T10:15:03.416352239Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}