CVE-2023-54404

What it actually does

Uncontrolled resource consumption in Zod allows memory exhaustion when a container schema such as z.array(), z.set() or z.map() without an explicit size bound receives a large input; the handleArrayResult (and equivalent) logic allocates one issue object per element with no cap or early termination.

Why it matters to the business

Applications that accept untrusted input through Zod schemas can be crashed or forced offline, producing denial-of-service conditions that interrupt services and require manual restarts or scaling actions.

How an attack unfolds

An attacker identifies an HTTP or API endpoint that validates request bodies or query parameters with an unbounded Zod container schema, then submits a single request containing a very large array, set or map; the parser builds an ever-growing list of per-element issue objects until the process runs out of memory and terminates.

How to fix it

Add explicit size constraints such as .max(N) to every container schema that receives untrusted data; monitor the Zod repository for a future opt-in error cap and upgrade to the first version that includes it once released; in the interim, place request-size limits or Web Application Firewall rules in front of affected endpoints.

How to confirm the fix worked

Review all Zod schema definitions for the presence of .max(), .length() or .size() on array, set and map types; test by sending oversized containers to each schema and confirming that validation fails early with a size error rather than accumulating issues.

Typical attack path

1. Discover an endpoint or function that uses a Zod container schema without .max(), .length() or .size()
2. Craft a request containing an extremely large array, set or map payload
3. Submit the payload to trigger per-element issue accumulation
4. Repeat or enlarge the payload until memory exhaustion occurs and the process crashes

How to detect it

Search application and system logs for sudden out-of-memory terminations or Node.js heap exhaustion events that coincide with requests containing unusually large JSON arrays, sets or maps; correlate with Zod validation paths if stack traces are available.

What your security team should do

• Immediately audit all Zod schemas that accept external input and add size bounds
• Implement request body size limits at the web server or proxy layer
• Track the Zod project for the proposed error-cap configuration and plan an upgrade
• Add memory and process crash alerts to production monitoring