Zod Denial of Service Vulnerability in express-zod-api
Summary
GHSA-mvrp-3cvx-c325: Zod denial of service vulnerability during email validation. Affects express-zod-api versions < 10.0.0-beta1. Fixed in 10.0.0-beta1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
express-zod-api is an npm package that provides a framework for building API servers using the Zod library for input validation. It allows developers to define validation schemas using Zod's expressive API. However, versions of express-zod-api below 10.0.0-beta1 are vulnerable to a denial of service (DoS) attack due to an inefficient regular expression complexity in the Zod library.
Vulnerability Detail
The vulnerability arises from the usage of the z.string().email() validation schema in express-zod-api implementations. The regular expression used for email validation in Zod versions up to 3.22.2 is inefficient and can be exploited to cause a DoS attack. An attacker can send specially crafted email inputs that trigger excessive backtracking in the regular expression, leading to high CPU usage and unresponsiveness of the API server. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 29.8.2 as of 23 Oct 2026
npm install express-zod-api@29.8.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.0.0-beta1
This is the first release that contains the fix.
npm install express-zod-api@10.0.0-beta1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
When it's not possible to upgrade your dependencies, consider the following replacement in your implementation:
- z.string().email()
+ z.string().regex(
+ /^(?!\.)(?!.*\.\.)([A-Z0-9_+-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i
+ )
This regular expression is taken from the suggested patch of Zod.
Conclusion
The Zod Denial of Service vulnerability in express-zod-api can be mitigated by upgrading to version 10.0.0-beta1 or applying the suggested regular expression workaround. It is crucial to address this vulnerability promptly to prevent potential DoS attacks on API servers. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for express-zod-api →
FAQ
The vulnerability allows an attacker to perform a DoS attack on API servers running express-zod-api. By sending specially crafted email inputs, the attacker can cause high CPU usage and make the server unresponsive.
Versions of express-zod-api below 10.0.0-beta1 are affected by this vulnerability.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix the vulnerability, upgrade express-zod-api to at least version 10.0.0-beta1 or replace the z.string().email() validation schema with the suggested regular expression.
Yes, the patched version of the Zod library is 3.22.3.
