AIKIDO-2026-143019
zod is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
zodTL;DR
Zod's array schema validation accumulates a new validation issue object for every element that fails a check, inside the handleArrayResult logic of $ZodArray, with no cap or early termination check on the total. Parsing a large array against an array schema that carries no length constraint lets each failing element add another issue object, so the process keeps allocating until it exhausts memory and crashes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you parse untrusted input against an array schema (z.array()) that has no maximum length constraint.
Background info
zod is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 4.6.5.
How to fix this
Upgrade the zod and/or the @zod/mini library to the patch version.
Links
CVE Detail
Fix PRs
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.