Executive brief
Zod is a popular TypeScript-first schema validation library used in thousands of web applications. The email validation function contains a regular expression vulnerable to Regular Expression Denial of Service (ReDoS) attacks, allowing attackers to craft malicious email strings that cause the validation process to consume excessive CPU and freeze the server. Applications using express-zod-api (which depends on Zod) for API request validation are at risk of service disruption.
Technical details
The vulnerability is an inefficient regular expression (CWE-1333) in Zod's email validation regex that exhibits exponential backtracking behavior when processing specially crafted input strings. The vulnerable regex uses nested quantifiers and alternation patterns that cause catastrophic backtracking, allowing an attacker to send a single malicious HTTP request containing a crafted email string to trigger excessive CPU consumption and denial of service. No authentication is required; the attack is network-accessible to any user who can send validation requests to an affected API endpoint. The vulnerability affects Zod versions up to 3.22.2 and express-zod-api versions before 10.0.0-beta1. Patches are available in Zod 3.22.3 and express-zod-api 10.0.0.
Affected products
- Colinhacks Zod up to 3.22.2
- RobinTail express-zod-api below 10.0.0-beta1
Timeline
- 2023-10-04: disclosed
- 2023-10-04: patched: Zod 3.22.3 and express-zod-api 10.0.0-beta1 released