high7.5
CVE-2023-54404
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Impact
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | zod | < 4.6.6 | 4.6.6 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-mrhx-c7xc-m3w5
- https://nvd.nist.gov/vuln/detail/CVE-2023-54404
- https://github.com/colinhacks/zod/issues/1872
- https://github.com/colinhacks/zod/pull/6475
- https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation
- https://github.com/colinhacks/zod/pull/6652
- https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd