CVE-2023-54404: Zod can exhaust memory while validating oversized constrained collections
(updated )
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.
References
- github.com/advisories/GHSA-mrhx-c7xc-m3w5
- github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd
- github.com/colinhacks/zod/issues/1872
- github.com/colinhacks/zod/pull/6475
- github.com/colinhacks/zod/pull/6652
- nvd.nist.gov/vuln/detail/CVE-2023-54404
- www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation
Code Behaviors & Features
Detect and mitigate CVE-2023-54404 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →