AIKIDO-2026-161437

zod is vulnerable to Regular Expression Denial of Service (ReDoS)

Regular Expression Denial of Service (ReDoS) Pre-CVE Published Yesterday

Low Risk

This Affects:

zod

3.21.0 - 4.4.3

Fixed in 4.5.0

Are you affected? Scan for Free

TL;DR

The emoji format validator (z.emoji() and z.string().emoji()) used ^(\p{Extended_Pictographic}|\p{Emoji_Component})+$. Those Unicode properties overlap on four hair-component code points (U+1F9B0–U+1F9B3), so a failed match re-explores exponentially many ways of attributing already-consumed characters. A roughly 100-byte string of those code points plus a trailing non-emoji character can stall the event loop for seconds, and RegExp.test() cannot be interrupted by a request timeout. The same pattern ships in zod, zod/mini, zod/v4-mini, and the bundled Zod 3 API. The fix collapses the alternation into a single character class so matching is linear.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application validates untrusted input with z.emoji() or z.string().emoji().