CVE-2023-54404

Summary

Zod's array validation logic fails to limit memory usage when processing large arrays without length constraints, leading to excessive memory allocation and potential application crashes from out-of-memory conditions.

Exploitability

Exploitation is straightforward with minimal preconditions - attackers only need to submit a large array to any endpoint using an unconstrained Zod array schema to trigger the memory exhaustion vulnerability.

Blast radius

The vulnerability affects any application using Zod's array validation without length constraints, potentially causing widespread service disruption across web applications and APIs that validate user input through Zod schemas.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Zod version 4.6.6 or later to address the uncontrolled resource consumption vulnerability in array validation logic.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.