Detections
Analytics

SCA: security update for zod (GHSA-mrhx-c7xc-m3w5)

high Tenable Self-Hosted Container Security Plugin ID 477178

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows
 attackers to exhaust memory by submitting a large array, set or map to an application that uses a
 container schema without an explicit size constraint. The handleArrayResult parse logic in $ZodArray (and
 the equivalent set and map paths) accumulates every validation issue for each failing element with no cap
 or early termination, causing the process to allocate one issue object per element and crash under out-of-
 memory conditions. This is reachable in the default configuration whenever a container schema such as
 z.array() is declared without a size bound. The upstream change in commit e06a510 (pull request 6652,
 first released in 4.6.6) only moves the .max(), .length() and .size() size checks to run before element
 parsing, so it rejects oversized input for schemas that declare an explicit upper bound; per the
 maintainer, unbounded containers are unchanged. No released version remediates the unbounded (default)
 case described here, and an opt-in setting to cap total accumulated errors was proposed but not merged.
 (CVE-2023-54404)

Solution

Update the zod library and its related packages to version 4.6.6 or later.

See Also

https://github.com/advisories/GHSA-mrhx-c7xc-m3w5

Plugin Details

Severity: High

ID: 477178

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/23/2026

Updated: 10/23/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.64

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2023-54404

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.2

Threat Score: 4.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/1/2026

Vulnerability Publication Date: 10/1/2026

Reference Information

CVE: CVE-2023-54404

cwe: CWE-770