ZAP JavaScript Engine Memory Leak Impacts Active Scan Usage

A critical memory leak has been disclosed in the JavaScript engine of the ZAP (Zed Attack Proxy) project, a widely used open-source web application security scanner.

This flaw, likely present for some time, now disrupts active scanning workflows following the introduction of a new JavaScript scan rule in the OpenAPI add-on.

Security teams relying on ZAP for dynamic application security testing (DAST) face potential denial-of-service-like conditions during scans.

ZAP maintainers issued the alert on January 28, 2026, emphasizing urgent remediation efforts. The memory leak manifests during active scans, where the JavaScript engine fails to properly deallocate resources, leading to rapid memory exhaustion.

This issue gained prominence after the OpenAPI add-on’s recent update incorporated the problematic JS scan rule, amplifying resource consumption in automated testing pipelines.

At its core, the vulnerability stems from inefficient memory handling within ZAP’s JavaScript engine, possibly tied to long-running script executions or unhandled garbage collection in scan rules.

Active scans ZAP’s hallmark feature for probing web apps via automated attacks like SQL injection and XSS trigger the leak when processing OpenAPI specifications with embedded JavaScript logic.

Impacts include:

• Crashes or hangs in scanning sessions, halting vulnerability discovery.
• Elevated resource usage on scanning hosts, risking broader infrastructure strain in CI/CD environments.
• Delayed security assessments for DevSecOps teams using ZAP in Docker or standalone deployments.

The flaw does not expose scanned applications to exploits but undermines ZAP’s reliability as a security tool, potentially delaying patch identification in production-like environments.

Mitigation and Release Updates

To curb immediate risks, the OpenAPI add-on has been patched to disable the offending JS scan rule by default. Users must update to the latest version for this workaround. Nightly and weekly ZAP releases are now available with the fix, alongside refreshed Docker images for weekly and live channels.

Developers should verify installations via zaproxy –version and re-enable the rule only post-root fix.

ZAP maintainers are prioritizing a permanent resolution to the JavaScript engine leak, with ongoing commits expected soon. This incident underscores the challenges of integrating dynamic scripting in security tools, where performance bugs can cascade into operational vulnerabilities.

Security professionals are advised to monitor ZAP’s GitHub repository and announcements for the stable release. In the interim, fallback to passive scans or alternative tools like Burp Suite may bridge gaps.

Recently he Zed Attack Proxy (ZAP) team has released the OWASP PTK add-on, version 0.2.0 alpha, integrating the OWASP Penetration Testing Kit (PTK) browser extension directly into ZAP-launched browsers.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.