{"id":"CVE-2023-54404","title":"Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema…","summary":"Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770","CWE-1188"],"vendor":"colinhacks","product":"zod","affected":["zod <= 4.6.5"],"published":"2026-10-01","updated":"2026-10-13","sourceUpdated":"2026-10-13T17:17:13.430","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","references":[{"url":"https://github.com/colinhacks/zod/issues/1872","label":"disclosure@vulncheck.com"},{"url":"https://github.com/colinhacks/zod/pull/6475","label":"disclosure@vulncheck.com"},{"url":"https://github.com/colinhacks/zod/pull/6652","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54404.json"},{"url":"https://access.redhat.com/security/cve/CVE-2023-54404"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544881"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-54404"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404"},{"url":"https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"},{"url":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5"}],"tags":["nvd","cve.org","csaf","vex","red-hat","ghsa","npm"],"epss":0.00346,"epssPercentile":0.27983,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-06T01:56:37.688335Z"},"ingestedAt":"2026-10-01T18:55:42.367Z","aliases":["GHSA-mrhx-c7xc-m3w5"],"ecosystem":"npm","patched":["zod 4.6.6"],"slug":"CVE-2023-54404","body":"## Overview\n\nZod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Ansible Automation Orchestrator 2026, Cost Management On Premise, Migration Toolkit for Applications 8, Red Hat Ansible Automation Platform 2, Red Hat Build of Keycloak, Red Hat Build of Podman Desktop, … · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift GitOps, Secrets Management Console for Red Hat OpenShift, Ansible Automation Orchestrator 2026, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54404.json)\n\n## Package advisory (CVE-2023-54404)\n\nAffected packages:\n\n- `zod < 4.6.6`\n\nPatched in:\n\n- `zod 4.6.6`\n\nSource: https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}