Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
The CVE Numbering Authority rejected this vulnerability record, and the zod maintainers closed the upstream report (https://github.com/colinhacks/zod/issues/1872) as expected behavior. Zod reports every failing element of an array, so its work grows only with input the application has already parsed. Applications are expected to bound untrusted input with a request-size limit or a schema bound such as .max(), so there is no defect in zod to fix.
Status