zod (npm)
TypeScript-first schema validation with static type inference
Advisories
3
Latest version
4.6.7
Released Oct 12, 2026
License
MIT
OpenSSF Scorecard
5.1 / 10
How to fix
Upgrading to 4.6.6 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install zod@4.6.7yarn
yarn add zod@4.6.7pnpm
pnpm add zod@4.6.7Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 Zod can exhaust memory while validating oversized constrained collections |
High EPSS 0.35% |
< 4.6.6 | 4.6.6 |
| GHSA-mrhx-c7xc-m3w5 Zod can exhaust memory while validating oversized constrained collections |
High EPSS 0.35% |
< 4.6.6 | 4.6.6 |
| GHSA-m95q-7qp3-xv42 Zod denial of service vulnerability |
High EPSS 0.92% |
< 3.22.3 | 3.22.3 |
Source: git+https://github.com/colinhacks/zod.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor