How severe is GHSA-mvrp-3cvx-c325?

GHSA-mvrp-3cvx-c325 has a CVSS score of 7.5/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by GHSA-mvrp-3cvx-c325?

GHSA-mvrp-3cvx-c325 affects the following packages: express-zod-api (npm). Ecosystems affected: npm.

How do I fix GHSA-mvrp-3cvx-c325?

Update express-zod-api to 10.0.0-beta1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mvrp-3cvx-c325 is resolved across your whole dependency graph.

How do I detect GHSA-mvrp-3cvx-c325 in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for express-zod-api, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-mvrp-3cvx-c325 if there is no patch (or I can't update yet)?

Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Is GHSA-mvrp-3cvx-c325 actively exploited in the wild?

No public exploit code has been indexed for GHSA-mvrp-3cvx-c325 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-mvrp-3cvx-c325 published, and has it been updated?

GHSA-mvrp-3cvx-c325 was published on October 4, 2023. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦

📦 npm

Not in CISA KEV

HIGH severity

Zod denial of service vulnerability during email validationGHSA-mvrp-3cvx-c325

HIGHFix: colinhacks/zod#2824

GHSA-mvrp-3cvx-c325 is a high-severity (CVSS 7.5) vulnerability in express-zod-api. A fix is available for express-zod-api — see the affected versions and patch details below.

Published

Oct 4, 2023

Updated

Oct 4, 2023

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Oct 4, 2023 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

6other npm packages depend on this — each one inherits the vulnerability until it's patched upstream

express-zod-apinpm

53Kdownloads / week

Description

Impact

API servers running express-zod-api having:

version of express-zod-api below 10.0.0-beta1,
and using the following (or similar) validation schema in its implementation: z.string().email(),

are vulnerable to a DoS attack due to:

Inefficient Regular Expression Complexity in zod versions up to 3.22.2,
depending on zod.

Patches

The patched version of zod fixing the vulnerability is 3.22.3.

However, it's highly recommended to upgrade express-zod-api to at least version 10.0.0, which does not depend on zod strictly and directly, but requires its installation as a peer dependency instead, enabling you to install the patched zod version yourself.

Workarounds

When it's not possible to upgrade your dependencies, consider the following replacement in your implementation:

- z.string().email()
+ z.string().regex(
+   /^(?!\.)(?!.*\.\.)([A-Z0-9_+-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i
+ )

This regular expression is taken from the suggested patch of zod.

References

Original issue: https://github.com/colinhacks/zod/issues/2609
The patch: https://github.com/colinhacks/zod/pull/2824
Entry in database: https://nvd.nist.gov/vuln/detail/CVE-2023-4316
Enumeration: https://cwe.mitre.org/data/definitions/1333.html
Parent advisory: https://github.com/advisories/GHSA-m95q-7qp3-xv42
Changelog entry for express-zod-api version 10.0.0-beta1: https://github.com/RobinTail/express-zod-api/blob/master/CHANGELOG.md#v1000-beta1

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`express-zod-api`	all versions	10.0.0-beta1`npm install express-zod-api@10.0.0-beta1`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for express-zod-api, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update express-zod-api to 10.0.0-beta1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mvrp-3cvx-c325 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Frequently Asked Questions

### Impact API servers running `express-zod-api` having: - version of `express-zod-api` below `10.0.0-beta1`, - and using the following (or similar) validation schema in its implementation: `z.string().email()`, are vulnerable to a DoS attack due to: - Inefficient Regular Expression Complexity in `zod` versions up to `3.22.2`, - depending on `zod`. ### Patches The patched version of `zod` fixing the vulnerability is `3.22.3`. However, it's highly recommended to upgrade `express-zod-api` to at least version `10.0.0`, which does not depend on `zod` strictly and directly, but requires its

O3 Security · Impact-Aware SCA

Is GHSA-mvrp-3cvx-c325 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works