CVE-2026-6991

MediumCVSS 6.3

Published: 25/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

A vulnerability was determined in colinhacks Zod up to 4.3.6 affecting an unknown function of the file packages/zod/src/v4/core/regexes.ts in the CUID Data Type Handler component. Manipulation can lead to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized; the vendor did not respond to the disclosure.

Risk Assessment

Applications using Zod for input validation may be exposed to SQL injection, risking unauthorized database access.

Recommendation

Update Zod to a version newer than 4.3.6 once a fix is available, and apply additional validation and parameterized queries at the database layer.

Other vulnerabilities in Zod

CVE-2023-54404Low risk· EPSS 28%
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.

Original NVD description (English source)

A vulnerability was determined in colinhacks Zod up to 4.3.6. The impacted element is an unknown function of the file packages/zod/src/v4/core/regexes.ts of the component CUID Data Type Handler. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS