Repository navigation
[GHSA-mrhx-c7xc-m3w5] Withdraw: source CVE-2023-54404 disputed by its CNA - #10750
Open
colinhacks wants to merge 1 commit into
Conversation
github-actions
Bot
changed the base branch from
main
to
colinhacks/advisory-improvement-10750
October 28, 2026 17:42
Author
|
Update: VulnCheck has rejected CVE-2023-54404, and NVD reflects it.
VulnCheck's rejection reason: "The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod." This advisory's only source is now a rejected CVE, so please withdraw it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I maintain Zod. CVE-2023-54404 describes intended behavior, and its CNA, VulnCheck, tagged it disputed on 2026-10-28 while it reviews my rejection request:
disputed)Nobody contacted me before the CVE was published on 2026-10-01, or before VulnCheck widened it on 2026-10-22. Both times I found out from users whose CI had started failing.
Reporting every issue is a design decision.
safeParse()andparse()promise the caller the complete list of issues in the input, so a form or an API can show every problem at once instead of one per round trip. That means the work on a failing parse grows with the input. A schema with no size bound accepts input of any size by declaration, the same wayJSON.parsedoes. An application that parses untrusted input caps it with a request body limit, or with a schema bound like.max(), which since 4.6.6 rejects an oversized collection before any element is parsed (colinhacks/zod#6652).Zod also offers a validator that stops at the first failure.
schema.validate(data), orz.validate(schema, data), returns a boolean and settles on the first failing element, so it never collects issues. On a compiled schema (z.compile()) it answers from the compiled fast path. Against 10 million invalid elements with a 2 GB heap,safeParse()runs out of memory, while.validate()returnsfalsewith under 100 MB of heap growth.Other validators behave the same way, and none of them has an advisory for it. Each library below got the same unbounded array-of-strings schema and
Array(n).fill(0), run under Node 26 with a 2 GB heap:abortEarly: false: 1M errors and 3.4 GB of heap at 1MabortEarly: false: stack overflow at 1MallErrors: true: 10M errorsIf this is a vulnerability in Zod, it is one in every validator that reports all errors. The remedy is the same everywhere: bound the input, or ask for a boolean.
The cited "researcher disclosure", colinhacks/zod#1872, is a 2023 design discussion about early exit, not a vulnerability report.
Please withdraw this advisory.