VDB
CVE-2023-54404
CVE-2023-54404
REJECTED
CVSS 8.199999809265137 HIGH
Reported by VulnCheck · Published October 1, 2026
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.
EPSS 0.35% · 27.9th percentile
Risk Scores
CVSS 4.0
8.199999809265137
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.35%
27.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| wolfi | vitess-24 | 0 |
| chainguard | authentik-2026.5 | 0 |
| chainguard | authentik-2025.12 | 0 |
| chainguard | rstudio | 0 |
| chainguard | vitess-24 | 0 |
| colinhacks | zod | 0, e06a510b6fc1e6e28e3201fd116ca2a76212f6be, 0 |
| chainguard | wazuh-dashboard-fips | 0 |
| chainguard | arangodb-3.12 | 0 |
| npm | zod | 0 |
| wolfi | code-server | 0 |
| chainguard | openspec | 0 |
| wolfi | rstudio | 0 |
| zod | zod | |
| chainguard | authentik-fips-2026.5 | 0 |
| chainguard | wazuh-dashboard | 0 |
| wolfi | langfuse-3 | 0 |
| chainguard | code-server | 0 |
Timeline
- Oct 1, 2026 Coalition ESS Score
- Oct 2, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 8, 2026 EPSS Score
- Oct 11, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-54404 advisory
- https://github.com/advisories/GHSA-mrhx-c7xc-m3w5 advisory
- https://github.com/colinhacks/zod/issues/1872 url
- https://github.com/colinhacks/zod/pull/6475 patch
- https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation url
- https://github.com/colinhacks/zod/pull/6652 patch
- https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd patch