How Zod's .refine() Can Cause a Denial of Service — And How to Fix It

TL;DR Zod's .refine() executes on every input — even when earlier validators like .min() and .max() have already failed. If you place an expensive operation such as a database query inside .refine() , an attacker can trigger that query with every request, including requests containing completely invalid inputs that would never pass validation. Flood enough of those requests concurrently and the server goes down. The fix is one line away — validate first, query after — but only if you know the be