CVE-2023-54404: High-Risk Memory Exhaustion Vulnerability in Zod Library

• •CVE-2023-54404 allows memory exhaustion via oversized arrays in Zod library.
• •High operational risk for internet-facing APIs using Zod for validation.
• •No active exploitation reported; mitigation includes capping request sizes.

A vulnerability identified as CVE-2023-54404 in the Zod schema-validation library version 4.6.5 allows attackers to exploit uncontrolled resource consumption by submitting oversized arrays. This can lead to memory exhaustion and application crashes, particularly affecting internet-facing APIs and web backends that validate user-controlled arrays. The flaw does not currently show signs of active exploitation, but it poses a high operational risk, especially for services without constraints on array sizes. Users are advised to monitor for unusually large array submissions and implement limits on request sizes until a fix is confirmed. The vulnerability was published on October 1, 2026, with a CVSS score of 8.2, indicating a high severity level. Mitigation strategies include capping request sizes and implementing early termination for validation errors.