Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
HIGH severity

GHSA-mvrp-3cvx-c325 express-zod-api

HIGHFix: colinhacks/zod#2824

GHSA-mvrp-3cvx-c325 is a high-severity (CVSS 7.5) vulnerability in express-zod-api. A fix is available for express-zod-api — see the affected versions and patch details below.

Zod denial of service vulnerability during email validation

Published
Oct 4, 2023
Updated
Oct 4, 2023
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 4, 2023 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

6other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
express-zod-apinpm
19Kdownloads / week

Description

Impact

API servers running express-zod-api having:

  • version of express-zod-api below 10.0.0-beta1,
  • and using the following (or similar) validation schema in its implementation: z.string().email(),

are vulnerable to a DoS attack due to:

  • Inefficient Regular Expression Complexity in zod versions up to 3.22.2,
  • depending on zod.

Patches

The patched version of zod fixing the vulnerability is 3.22.3.

However, it's highly recommended to upgrade express-zod-api to at least version 10.0.0, which does not depend on zod strictly and directly, but requires its installation as a peer dependency instead, enabling you to install the patched zod version yourself.

Workarounds

When it's not possible to upgrade your dependencies, consider the following replacement in your implementation:

- z.string().email()
+ z.string().regex(
+   /^(?!\.)(?!.*\.\.)([A-Z0-9_+-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i
+ )

This regular expression is taken from the suggested patch of zod.

References

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmexpress-zod-apiall versions10.0.0-beta1npm install express-zod-api@10.0.0-beta1

Detection & mitigation playbook

Open-source dependency
  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for express-zod-api, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update express-zod-api to 10.0.0-beta1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mvrp-3cvx-c325 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-mvrp-3cvx-c325 can be triaged on real exposure rather than presence alone.

Tailored to GHSA-mvrp-3cvx-c325. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Impact API servers running `express-zod-api` having: - version of `express-zod-api` below `10.0.0-beta1`, - and using the following (or similar) validation schema in its implementation: `z.string().email()`, are vulnerable to a DoS attack due to: - Inefficient Regular Expression Complexity in `zod` versions up to `3.22.2`, - depending on `zod`. ### Patches The patched version of `zod` fixing the vulnerability is `3.22.3`. However, it's highly recommended to upgrade `express-zod-api` to at least version `10.0.0`, which does not depend on `zod` strictly and directly, but requires its
O3 Security · Impact-Aware SCA

Is GHSA-mvrp-3cvx-c325 in your dependencies?

O3 Security finds GHSA-mvrp-3cvx-c325 across npm dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

GHSA-mvrp-3cvx-c325: express-zod (High 7.5) | O3 Security