VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Jun 7, 2024· Updated Aug 2, 2024

zsa Generates Error Messages Containing Sensitive Information

CVE-2024-37162

Description

zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially reveal sensitive information about the server environment, such as the machine username and directory paths. An attacker could exploit this vulnerability to gain unauthorized access to sensitive server information. This information could be used to plan further attacks or gain a deeper understanding of the server infrastructure. This has been patched on 0.3.3.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
zsanpm
< 0.3.30.3.3

Affected products

1

Patches

1
86b86b282bde

remove stack from errors

https://github.com/IdoPesok/zsaIdo PesokJun 6, 2024via ghsa
commit
7 files changed · +39 −7
  • examples/showcase/app/revalidate/component.tsx+17 −0 added
    @@ -0,0 +1,17 @@
+"use client"
+
+import IncrementExample from "@/content/docs/examples/introduction/increment-example"
+import { useState } from "react"
+
+export default function RevalidateComponent() {
+  const [open, setOpen] = useState(false)
+  return (
+    <div>
+      {open ? (
+        <IncrementExample />
+      ) : (
+        <button onClick={() => setOpen(true)}>Open</button>
+      )}
+    </div>
+  )
+}
  • examples/showcase/app/revalidate/page.tsx+15 −0 added
    @@ -0,0 +1,15 @@
+import RevalidateComponent from "./component"
+
+export default async function RevalidatePage() {
+  // sleep for 2 seconds
+  await new Promise((resolve) => setTimeout(resolve, 1000))
+  const randomNumber = Math.floor(Math.random() * 10000)
+
+  return (
+    <div>
+      <h1>Revalidate Page</h1>
+      <p>Random number: {randomNumber}</p>
+      <RevalidateComponent />
+    </div>
+  )
+}
  • examples/showcase/content/docs/examples/introduction/actions.ts+5 −1 modified
    @@ -1,5 +1,6 @@
 "use server"
 
+import { revalidatePath } from "next/cache"
 import z from "zod"
 import { createServerAction } from "zsa"
 
@@ -11,7 +12,10 @@ export const incrementNumberAction = createServerAction()
   )
   .handler(async ({ input }) => {
     await new Promise((resolve) => setTimeout(resolve, 500))
-    return input.number + 1
+
+    revalidatePath("/revalidate", "page")
+
+    return input.number + 2
   })
 
 export const plainAction = createServerAction().handler(async () => {
  • examples/showcase/content/docs/examples/introduction/increment-example.tsx+2 −0 modified
    @@ -3,6 +3,7 @@
 import { Button } from "@/components/ui/button"
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card"
 import { useState } from "react"
+import { toast } from "sonner"
 import { useServerAction } from "zsa-react"
 import { incrementNumberAction } from "./actions"
 
@@ -31,6 +32,7 @@ export default function IncrementExample() {
               return
             }
 
+            toast("got data" + data)
             setCounter(data)
           }}
         >
  • packages/zsa/src/errors.ts+0 −2 modified
    @@ -57,7 +57,6 @@ export type TZSAError<TInputSchema extends z.ZodType> = Error &
     | {
         code: Exclude<keyof typeof ERROR_CODES, "INPUT_PARSE_ERROR">
         message?: string
-        stack: string
         data: string
         name: string
         fieldErrors?: undefined
@@ -66,7 +65,6 @@ export type TZSAError<TInputSchema extends z.ZodType> = Error &
       }
     | {
         message?: string
-        stack: string
         code: "INPUT_PARSE_ERROR"
         data: string
         name: string
  • packages/zsa/src/zod-safe-function.ts+0 −1 modified
    @@ -512,7 +512,6 @@ export class ZodSafeFunction<
       {
         data: stringifyIfNeeded(customError.data),
         name: customError.name,
-        stack: JSON.stringify(customError.stack),
         message: stringifyIfNeeded(customError.message),
         code: customError.code,
         fieldErrors: flattenedErrors?.fieldErrors,
  • tests/jest/__tests__/openapi.test.tsx+0 −3 modified
    @@ -165,7 +165,6 @@ describe("openapi", () => {
       const json = await response.json()
       expect(json.code).toBe("INPUT_PARSE_ERROR")
       expect(json.message).toBeDefined()
-      expect(json.stack).not.toBeDefined()
     })
 
     it("should multiply two numbers [POST]", async () => {
@@ -387,7 +386,6 @@ describe("openapi", () => {
       const json = await response.json()
       expect(json.code).toBe("INPUT_PARSE_ERROR")
       expect(json.message).toBeDefined()
-      expect(json.stack).toBeDefined()
       expect(json.name).toBeDefined()
     })
 
@@ -419,7 +417,6 @@ describe("openapi", () => {
       const json = await response.json()
       expect(json.code).toBe("INPUT_PARSE_ERROR")
       expect(json.message).toBeDefined()
-      expect(json.stack).not.toBeDefined()
     })
   })

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.