CVE-2023-54404
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The Zod schema-validation library contains an uncontrolled resource consumption vulnerability: an attacker can exhaust memory by submitting a large array, set, or map to an application using a container schema without an explicit size constraint. The $ZodArray parse logic (and equivalent set and map paths) accumulates every validation issue for each failing element with no cap, causing one issue object per element and an out-of-memory crash. The fix in 4.6.6 only addresses schemas with an explicit upper bound; the unbounded default case remains unmitigated.
Risk Assessment
Applications using Zod with unbounded container schemas can be remotely driven to memory exhaustion and crash, causing denial of service.
Recommendation
Always declare explicit size bounds (.max(), .length(), .size()) for array, set, and map schemas. Limit incoming request sizes at the proxy or application level.
Related vulnerabilities
- CVE-2026-94075Critical
The WordPress plugin Newsletters (newsletters-lite) up to version 4.18.1 contains a deserialization of untrusted data vulnerability, allowing object injection. This could enable an attacker to execute unintended code.
- CVE-2026-114196Critical
The WordPress plugin Paytium up to version 5.0.5 is vulnerable to deserialization of untrusted data, allowing object injection. This may enable an attacker to perform unauthorized actions.
- CVE-2026-112866Critical
The WordPress plugin Product Filter by WBW (woo-product-filter) up to version 3.4.6 is vulnerable to blind SQL injection due to improper neutralization of special elements in SQL commands. An attacker could exploit this to manipulate database queries.
- CVE-2026-111402Critical
The WordPress plugin Newsletters (newsletters-lite) up to version 4.18.1 is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. This could allow an attacker to execute arbitrary SQL queries.
- CVE-2026-115806Critical
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine. An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint. When an administrator performs a routine export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library, so no additional plugin or theme is required.
- CVE-2026-115931Critical
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels, but the backend did not restrict which functions could be requested, allowing calls to internal helpers. One helper reads a file from the server's disk (e.g., environment file with the session signing secret, database address, and service credentials), and another makes the backend process exit with a single request. Self-registration is open by default, so no existing account or action by another user is needed.
- CVE-2026-115893Critical
Wasmtime prior to 36.0.19, 48.0.7, and 49.0.4 has a flaw in the Cranelift compiler on aarch64. A br_table instruction with more than ~256,000 targets can be miscompiled, allowing a jump to arbitrary code and sandbox escape.
- CVE-2026-115889Critical
Wasmtime prior to 36.0.19 and 43.0.0 has a flaw in the Cranelift compiler where SSA value indices can silently overflow when compiling large Wasm functions. This can cause miscompilation, type confusion, and sandbox escape.
- CVE-2026-115812Critical
A relative path traversal during model archive extraction in AWS Multi Model Server 1.1.11 and earlier allows remote actors to execute arbitrary code via a crafted model archive. The project is end of life and no fixed version is available.
- CVE-2026-55486Critical
In Goobi viewer from version 25.08 to before 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token accept an origin query parameter without validation and embed it into the Content-Security-Policy header and an HTML response body as a postMessage argument. Since the attacker controls both calls, the unescaped value yields reflected XSS.
Original NVD description (English source)
Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array, set or map to an application that uses a container schema without an explicit size constraint. The handleArrayResult parse logic in $ZodArray (and the equivalent set and map paths) accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate one issue object per element and crash under out-of-memory conditions. This is reachable in the default configuration whenever a container schema such as z.array() is declared without a size bound. The upstream change in commit e06a510 (pull request 6652, first released in 4.6.6) only moves the .max(), .length() and .size() size checks to run before element parsing, so it rejects oversized input for schemas that declare an explicit upper bound; per the maintainer, unbounded containers are unchanged. No released version remediates the unbounded (default) case described here, and an opt-in setting to cap total accumulated errors was proposed but not merged.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS