Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | cockpit-image-builder | 110.3-1.el10_3 | RHSA-2026:98613 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | cockpit-image-builder | 110.3-1.el10_3 | RLSA-2026:98613 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | code-server | 4.143.1-r2 | — |
| Wolfi rolling | jitsucom-jitsu-console | No fix yet | — |
| Wolfi rolling | langfuse-3 +1 | 3.225.14-r1 | — |
| Wolfi rolling | rstudio | 2026.10.0_p233-r2 | — |
| Wolfi rolling | vitess-24 | 24.0.5-r4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | zod | < 4.6.6 | 4.6.6 | GHSA-mrhx-c7xc-m3w5 |
Advisories 2
- RHSA-2026:98613 Red Hat Security Advisory: cockpit-image-builder security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:98613 Critical: cockpit-image-builder security update Rocky Linux Security Advisories · Nov 13, 2026