If you use Zod to validate data in your application, this deserves a close look: a security advisory published on October 1, 2026, describes a flaw that can exhaust server memory when a very large array is validated without a size limit.
What is the Zod vulnerability?
The flaw was registered as CVE-2023-54404 and affects Zod through version 4.6.5, according to the advisory description. When an array schema has no size limit, the handleArrayResult logic in $ZodArray stores one validation issue for every item that fails, with no cap and no early exit. If someone sends a huge invalid array, those issues pile up until memory runs out, and the process may crash.
Why does it matter?
The advisory rates the flaw as high severity, with a CVSS 4.0 score of 8.2. The attack can be carried out over the network, without logging in and without any user action. The impact is on availability: the application may go down, which is known as denial of service. There is no mention of data leaks or data changes.
One detail: as of this article's date, the advisory is still marked as not reviewed by GitHub and does not list a patched version.
How to protect your applications
While the advisory does not announce an official fix, the most direct step is to avoid unbounded arrays in data that comes from outside your application:
- Set a maximum size on array schemas that receive data from users or other APIs, using Zod's .max() method with a value that makes sense for your case.
- Limit the request body size on your server or API, so a giant payload never reaches validation.
- Monitor memory usage of the services that validate external data.
- Follow the advisory on GitHub and new Zod releases so you can update as soon as a fix is announced.
Frequently asked questions
Is my application at risk?
The main risk is in services that use Zod to validate data sent by third parties, such as an API request body, with arrays that have no maximum size. Check your schemas and the Zod version installed in your project.
Is there a patched version yet?
The advisory does not list a patched version. Keep an eye on the advisory page and the Zod repository to find out when one is available.
How severe is the flaw?
High, with a CVSS 4.0 score of 8.2, and the impact is on system availability.
Where can I find more details?
In the GitHub Advisory Database and in the NVD, under the identifier CVE-2023-54404.
Next steps
Open the schemas in your project, look for arrays that receive external data and check that all of them have a size limit. If you want to go deeper into data validation and security in web development, the Hcode course platform has content you can study at your own pace.
Source
Zod can exhaust memory while validating oversized constrained collections, GitHub Advisory Database, October 1, 2026.