AIKIDO-2026-970919
zod is vulnerable to Regular Expression Denial of Service (ReDoS)
36
Low Risk
This Affects:
zodTL;DR
Zod's runtime base64 and base64url string-format validators use regular expressions whose repeated capturing groups recurse over the input. Validating a large or specially composed untrusted string with z.string().base64() or z.string().base64url() overflows the regex engine call stack and throws, aborting the parse. Applications that validate externally supplied strings through these formats can be crashed by a single oversized value. The fix rewrites the patterns to match in linear form so large inputs no longer exhaust the stack.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you validate untrusted input using the base64 or base64url string formats.
Background info
zod is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 3.25.9 - 4.5.4.
How to fix this
Upgrade the zod library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.