Zod's Validator Execution Flaw: A Path to Server Denial of Service

Zod's .refine() method executes validation logic on every input regardless of whether earlier validators have already rejected it, creating a critical DoS vector when expensive operations like database queries are involved. This vulnerability is particularly dangerous because it affects one of the most widely-used TypeScript validation libraries, and developers often assume validation stops after initial checks fail. The fix requires only a one-line change in approach, but the lack of awareness about this behavioral edge case leaves countless production applications exposed.