ROOT-APP-NPM-CVE-2023-54404 CVE-2023-54404 in zod - Patched by Root

Root has patched CVE-2023-54404 in the zod package for Root:npm. Multiple fixed versions available...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +13 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: OSV:GHSA-GCGF-FH7C-8GF2...

EUVD-2026-91793

@orpc/zod: Prototype injection in smart coercion...

@orpc/zod: Prototype injection in smart coercion

Summary ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of...

GHSA-GCGF-FH7C-8GF2 @orpc/zod: Prototype injection in smart coercion

Summary ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +13 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: GHSA-GCGF-FH7C-8GF2...

CVE-2026-103918

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918

The oRPC tool is vulnerable to prototype pollution in versions prior to 1.14.10 due to how the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin handle object and record properties. The root cause lies in resolving shape keys through the prototype chain , which allows a rem...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +13 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: MEND:CVE-2026-103918...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2023-54404

A flaw was found in zod. A remote attacker can trigger a denial of service DoS by submitting an excessively large array of invalid items to an application that validates input schemas without length constraints. Because the validation process accumulates error records for each failing element...

PT-2026-104428

Name of the Vulnerable Software and Affected Versions oRPC versions prior to 1.14.10 Description The @orpc/zod ZodSmartCoercionPlugin and experimental ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client c...

Linux Distros Unpatched Vulnerability : CVE-2023-54404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a...

CVE-2026-103918: Improperly Controlled Modification of Dynamically-Determined Object Attributes

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

Allocation of Resources Without Limits or Throttling

Overview zod is a TypeScript-first schema declaration and validation library with static type inference Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handleArrayResult parse logic in $ZodArray, which accumulates every validation...

CVE-2023-54404

Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the...

CVE-2023-54404 Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation

Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the...

CVE-2023-54404 Zod Uncontrolled Resource Consumption via Unbounded Array, Set, and Map Validation

Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array, set or map to an application that uses a container schema without an explicit size constraint. The handleArrayResult parse logic in...