Request bodies validated against schema

Unvalidated request bodies are the direct path to CWE-20 (Improper Input Validation) and OWASP A03:2021 (Injection). A handler that destructures req.body without parsing trusts whatever the client sends — malformed types, missing required fields, oversized strings, or injected payloads. Even without injection intent, unvalidated inputs cause runtime exceptions that leak stack traces, corrupt database records with wrong types, and produce 500 errors that hide the real cause from developers. iso-25010:2011 security.integrity requires that data entering the system be validated at the boundary.

Add schema validation to every endpoint that accepts a body. Use Zod's safeParse so validation failures return structured 400 errors rather than unhandled exceptions:

import { z } from 'zod'

const CreateUserSchema = z.object({
  name: z.string().min(1).max(100),
  email: z.string().email(),
  role: z.enum(['USER', 'ADMIN']).default('USER'),
})

const parsed = CreateUserSchema.safeParse(await req.json())
if (!parsed.success) {
  return Response.json(
    { error: { code: 'VALIDATION_ERROR', details: parsed.error.issues } },
    { status: 400 }
  )
}
const { name, email, role } = parsed.data

Validation errors must include field-level detail (details) so consumers can fix their requests without guessing.