Colinhacks Zod up to 4.6.5 Array Schema Validation handleArrayResult resource consumption

Summaryinfo

A vulnerability classified as problematic has been found in Colinhacks Zod up to 4.6.5. Impacted is the function handleArrayResult of the component Array Schema Validation. This manipulation causes resource consumption. This vulnerability is tracked as CVE-2023-54404. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Colinhacks Zod up to 4.6.5. It has been declared as problematic. Affected by this vulnerability is the function handleArrayResult of the component Array Schema Validation. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2023-54404 since 10/01/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Colinhacks

Name

• Zod

Version

• 4.6.0
• 4.6.1
• 4.6.2
• 4.6.3
• 4.6.4
• 4.6.5

Website

• Product: https://github.com/colinhacks/zod/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion