Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

express-zod-api

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    Zod denial of service vulnerability during email validation

    GHSA-mvrp-3cvx-c325

    Affected
    • npm express-zod-api < 10.0.0-beta1
    Fixed in
    10.0.0-beta1· Vendor fix available
    Issue
    Impact API servers running express-zod-api having: - version of express-zod-api below 10.0.0-beta1, - and using the following (or similar) validation schema in its implementation: z.string().email(), are vulnerable to a DoS attack due to: - Inefficient Regular Expression Complexity in zod versions up to 3.22.2, - depending on zod. Patches The patched version of zod fixing the vulnerability is 3.22.3. However, it's highly recommended to upgrade express-zod-api to at least version 10.0.0, which does not depend on zod strictly and directly, but requires its installation as a peer dependency instead, enabling you to install the patched zod version yourself. Workarounds When it's not possible to upgrade your dependencies, consider the following replacement in your implementation: This regular expression is taken from the suggested patch of zod. References - Original issue: https://github.com/colinhacks/zod/issues/2609 - The patch: https://github.com/colinhacks/zod/pull/2824 - Entry in…

    Recommended action: Upgrade to 10.0.0-beta1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →