CVE-2023-54404

Low risk· EPSS 28%

Published: 01/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

28th percentile - higher than 28% of all known CVEs

Summary

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.

Risk Assessment

Since the CVE is rejected, it is not considered a real vulnerability in Zod. Organizations do not need to take action for this identifier, though request-size limits are still recommended.

Recommendation

Do not treat this CVE as an active threat; confirm the rejected status in the NVD if needed. Consider implementing request-size limits in applications regardless of this report.

Other vulnerabilities in Zod

CVE-2026-6991Medium
A vulnerability was determined in colinhacks Zod up to 4.3.6 affecting an unknown function of the file packages/zod/src/v4/core/regexes.ts in the CUID Data Type Handler component. Manipulation can lead to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized; the vendor did not respond to the disclosure.

Original NVD description (English source)

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS