[maxigimenez]

Owner: @maxigimenez
Linear: n/a — opened by the scheduled dependency security triage

What and why

zod 4.3.5 → 4.6.7 (high; direct dependencies entry of @currents/mcp).

GHSA-mrhx-c7xc-m3w5 / CVE-2023-54404, patched in 4.6.6:

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.

Vanta has no finding for this repo's zod, so there is no SLA clock on it. It files the same CVE six times against currents-dev/currents (alerts 923–927, 934, due 2026-11-23), but nothing here. This came out of the lockfile sweep, not the worklist — a gap in scanner coverage rather than a sign the finding is minor. Worth knowing when you weigh it against the dated items.

Exposure

Runtime, and it ships. @currents/mcp is published to npm (files: [dist, assets, README.md], bin: mcp and currents-mcp-http), and zod resolves outside devDependencies:

node_modules/zod — version 4.3.5, no "dev": true
requesters: <root> ^4.3.5 · @modelcontextprotocol/sdk ^3.25 || ^4.0 · zod-to-json-schema ^3.25 || ^4

Every tool schema in src/tools/ is a zod object, so untrusted MCP tool arguments reach the parser directly. The advisory needs an array schema with no length constraint and an attacker-sized input to be reachable in practice.

The fix

lockfile-upgrade. All three requested ranges (^4.3.5, ^3.25 || ^4.0, ^3.25 || ^4) already admit 4.6.7, so no manifest edit was needed and none was made.

The diff is three lines in one stanza — version, resolved, integrity:

node_modules/zod: 4.3.5 → 4.6.7

Note that npm update zod in this sandbox also strips "libc": ["glibc"] / ["musl"] from 10 dev-only optional binary stanzas (@tailwindcss/oxide-linux-*, lightningcss-linux-*) — sandbox npm 10.9.4 writing metadata differently from CI. Those fields are the only discriminator between the gnu and musl variants, so losing them lets an Alpine install pick the wrong binary. I reverted that and applied the zod stanza by hand instead, which is why this diff is 3 lines rather than ~35. npm ci accepts the result.

Breaking-change check

Release notes read for the 4.3.5 → 4.6.7 range. Three behaviour changes, none of which this repo touches:

version	change	used here?
4.6.0	error maps now run when result.error is first read, not at parse time	no — grep 'z\.config|errorMap' in src/ finds nothing
4.6.0	z.emoji() rejects strings of only emoji-component characters ("123", "#")	no — z.emoji unused
4.6.3	removes the standalone z.properties() schema added in 4.6.0	no — added and removed inside this range; 4.3.5 never had it

4.6.6 is the security release; its relevant entry is fix(v4): check array, set and map size bounds before parsing elements. 4.6.7 carries no notes.

One caveat on completeness: GitHub's releases page shows 4.5.3 onward on page one, so 4.3.5 → 4.5.2 was not read release-by-release. No breaking-change or removal section surfaced for that span, but I did not verify it line by line.

No patches/ directory and no postinstall in this repo, so the patch-package trap does not apply.

Verification — run on this branch head

command	result
npm ci	clean, 0 peer-dependency warnings
git diff --name-only	mcp-server/package-lock.json — nothing else
installed version check	node_modules/zod reports 4.6.7
npm run build	pass — 9 files, 276.63 kB
npm run test:run	35/35 files, 1198/1198 tests pass
npm run format	"All matched files use Prettier code style!"
npm audit	zod advisory gone; repo total 9 high → 8 high

No integration tests are declared in this repo, so none were skipped.

CI coverage

.github/workflows/test.yml has no paths: filter, so this dependency-only diff triggers it rather than silently skipping — the failure mode where a lockfile change runs nothing and every required check still reports green.

Not triggered, and not expected to be: publish.yaml, release.yaml, promote.yaml, post-release.yaml, sync-from-monorepo.yaml, linear-release.yaml — all release-time or push-to-main workflows.

Why this is Tier B and does not auto-merge

Mechanically this is as narrow as a fix gets: one stanza, no manifest edit, no peer warnings, full test suite green. It is Tier B on one criterion — a direct dependencies entry of something that ships — and that rules out auto-merge however small the diff is. Left open for you.

Needs release

⚠️ The fix reaches users only when @currents/mcp is published. Merging closes the lockfile finding, but anyone who has already installed @currents/mcp keeps vulnerable zod until a release goes out.

• package: @currents/mcp, currently 2.7.0
• This routine does not publish, and no release was cut.

Worth coordinating with #240 (@modelcontextprotocol/sdk 1.31.0 → 1.32.0, Vanta alerts 173/176, due 2026-11-21) so one release carries both rather than two.

What a human should still check

1. Whether any tool schema takes an unbounded array from MCP tool arguments — that is what decides whether this was reachable or theoretical here.
2. Whether to cut a release, and whether to land chore(deps): bump @modelcontextprotocol/sdk from 1.31.0 to 1.32.0 in /mcp-server #240 first so a single publish closes both.

---

Generated by Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[baz-reviewer]

Baz Summary

Upgrade the runtime zod dependency used by MCP tool schemas from 4.3.5 to 4.6.7 to address uncontrolled resource consumption during array validation. Update the lockfile resolution while preserving existing manifests and package metadata.

Latest Contributors(2)

User	Commit	Date
noreply@anthropic.com	chore(deps): bump zod ...	October 27, 2026
github-actions[bot]@us...	chore: release v2.7.0	October 14, 2026

---

  _{Activate to get a short verdict whether this PR is good to go or not}

  _{Activate Skill Maintainer to keep your skills up to date}

  _{This PR would have been improved with Baz Planner - Try it now}