Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array, set or map to an application that uses a container schema without an explicit size constraint. The handleArrayResult parse logic in $ZodArray (and the equivalent set and map paths) accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate one issue object per element and crash under out-of-memory conditions. This is reachable in the default configuration whenever a container schema such as z.array() is declared without a size bound. The upstream change in commit e06a510 (pull request 6652, first released in 4.6.6) only moves the .max(), .length() and .size() size checks to run before element parsing, so it rejects oversized input for schemas that declare an explicit upper bound; per the maintainer, unbounded containers are unchanged. No released version remediates the unbounded (default) case described here, and an opt-in setting to cap total accumulated errors was proposed but not merged.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows
    attackers to exhaust memory by submitting a large array, set or map to an application that uses a
    container schema without an explicit size constraint. The handleArrayResult parse logic in $ZodArray (and
    the equivalent set and map paths) accumulates every validation issue for each failing element with no cap
    or early termination, causing the process to allocate one issue object per element and crash under out-of-
    memory conditions. This is reachable in the default configuration whenever a container schema such as
    z.array() is declared without a size bound. The upstream change in commit e06a510 (pull request 6652,
    first released in 4.6.6) only moves the .max(), .length() and .size() size checks to run before element
    parsing, so it rejects oversized input for schemas that declare an explicit upper bound; per the
    maintainer, unbounded containers are unchanged. No released version remediates the unbounded (default)
    case described here, and an opt-in setting to cap total accumulated errors was proposed but not merged.
    (CVE-2023-54404)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability     that allows attackers to exhaust memory by submitting a large array to an application using an array     schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray,     which accumulates every validation issue for each failing element with no cap or early termination,     causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.
    (CVE-2023-54404)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477178	SCA: security update for zod (GHSA-mrhx-c7xc-m3w5)	Tenable Cloud Security	SCA Checks	Local	high
477178	SCA: security update for zod (GHSA-mrhx-c7xc-m3w5)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
362666	Linux Distros Unpatched Vulnerability : CVE-2023-54404	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2023-54404

high

Tenable Plugins

high

high

high