---
id: CVE-2023-54404
title: >-
  Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains
  an uncontrolled resource consumption vulnerability that allows attackers to
  exhaust memory by submitting a large array to an application using an array
  schema…
summary: >-
  Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains
  an uncontrolled resource consumption vulnerability that allows attackers to
  exhaust memory by submitting a large array to an application using an array
  schema…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
  - CWE-1188
vendor: colinhacks
product: zod
affected:
  - zod <= 4.6.5
published: '2026-10-01'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:13.430'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-54404'
references:
  - url: 'https://github.com/colinhacks/zod/issues/1872'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/colinhacks/zod/pull/6475'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/colinhacks/zod/pull/6652'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation
    label: disclosure@vulncheck.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54404.json
  - url: 'https://access.redhat.com/security/cve/CVE-2023-54404'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2544881'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2023-54404'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-54404'
  - url: >-
      https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd
  - url: 'https://github.com/advisories/GHSA-mrhx-c7xc-m3w5'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.00346
epssPercentile: 0.27983
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-06T01:56:37.688335Z'
ingestedAt: '2026-10-01T18:55:42.367Z'
aliases:
  - GHSA-mrhx-c7xc-m3w5
ecosystem: npm
patched:
  - zod 4.6.6
---

## Overview

Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Ansible Automation Orchestrator 2026, Cost Management On Premise, Migration Toolkit for Applications 8, Red Hat Ansible Automation Platform 2, Red Hat Build of Keycloak, Red Hat Build of Podman Desktop, … · no fix planned: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift GitOps, Secrets Management Console for Red Hat OpenShift, Ansible Automation Orchestrator 2026, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54404.json)

## Package advisory (CVE-2023-54404)

Affected packages:

- `zod < 4.6.6`

Patched in:

- `zod 4.6.6`

Source: https://github.com/advisories/GHSA-mrhx-c7xc-m3w5