ROOT-APP-NPM-CVE-2023-54404 CVE-2023-54404 in zod - Patched by Root

Root has patched CVE-2023-54404 in the zod package for Root:npm. Multiple fixed versions available...

EUVD-2026-91793

@orpc/zod: Prototype injection in smart coercion...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +13 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: OSV:GHSA-GCGF-FH7C-8GF2...

GHSA-GCGF-FH7C-8GF2 @orpc/zod: Prototype injection in smart coercion

Summary ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of...

@orpc/zod: Prototype injection in smart coercion

Summary ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +13 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: GHSA-GCGF-FH7C-8GF2...

CVE-2026-103918

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918

The oRPC tool is vulnerable to prototype pollution in versions prior to 1.14.10 due to how the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin handle object and record properties. The root cause lies in resolving shape keys through the prototype chain , which allows a rem...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +13 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: MEND:CVE-2026-103918...

SUSE CVE-2023-54404

Zod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array, set or map to an application that uses a container schema without an explicit size constraint. The handleArrayResult parse logic in...

CVE-2023-54404

A flaw was found in zod. A remote attacker can trigger a denial of service DoS by submitting an excessively large array of invalid items to an application that validates input schemas without length constraints. Because the validation process accumulates error records for each failing element...

PT-2026-104428

Name of the Vulnerable Software and Affected Versions oRPC versions prior to 1.14.10 Description The @orpc/zod ZodSmartCoercionPlugin and experimental ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client c...

CVE-2026-103918: Improperly Controlled Modification of Dynamically-Determined Object Attributes

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

Linux Distros Unpatched Vulnerability : CVE-2023-54404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a...

GHSA-MRHX-C7XC-M3W5 Zod can exhaust memory while validating oversized constrained collections

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic ...

Zod can exhaust memory while validating oversized constrained collections

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic ...

0xstack (>=0.1.5, <=1.2.0), 21millionpixels-mcp (>=0.2.0, <=0.2.1) +17660 more potentially affected by CVE-2023-54404 via zod (>=4.0.0-beta.20250411T005215, <=4.6.5)

zod NPM version =4.0.0-beta.20250411T005215, =0.1.5, =0.2.0, =0.1.0, =0.8.0, =0.0.1-251016.84253, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =1.0.1, =1.0.0-alpha.2, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2023-54404 Source advisory: SNYK:JS-ZOD-20510278...