Express 5 + Zod 4 request validation: working versions (tested 2026-10-15)

{
  "name": "express-zod-validation",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "express": "5.3.0",
    "zod": "4.6.7"
  },
  "devDependencies": {
    "tsx": "4.23.15",
    "@types/node": "24.19.2",
    "supertest": "7.3.1",
    "@types/express": "5.0.6",
    "@types/supertest": "7.2.1"
  }
}

import express, { type Request, type Response, type NextFunction } from "express";
import { z, type ZodType } from "zod";

export function validateBody<T>(schema: ZodType<T>) {
  return (req: Request, res: Response, next: NextFunction) => {
    const result = schema.safeParse(req.body);
    if (!result.success) {
      return res.status(400).json({ error: "invalid_body", issues: z.flattenError(result.error).fieldErrors });
    }
    req.body = result.data;
    next();
  };
}

export const CreateUser = z.object({
  email: z.email(),
  name: z.string().min(1).max(80),
  age: z.number().int().min(13).optional(),
});

export function createApp() {
  const app = express();
  app.use(express.json());
  app.post("/users", validateBody(CreateUser), (req, res) => {
    res.status(201).json({ id: 1, ...req.body });
  });
  return app;
}

import { test } from "node:test";
import assert from "node:assert/strict";
import request from "supertest";
import { createApp } from "../src/app.ts";

test("accepts a valid body", async () => {
  const res = await request(createApp()).post("/users").send({ email: "a@example.com", name: "Ada" });
  assert.equal(res.status, 201);
  assert.equal(res.body.email, "a@example.com");
});

test("rejects an invalid body with field errors", async () => {
  const res = await request(createApp()).post("/users").send({ email: "nope", name: "" });
  assert.equal(res.status, 400);
  assert.ok(res.body.issues.email);
  assert.ok(res.body.issues.name);
});

test("strips unknown keys", async () => {
  const res = await request(createApp()).post("/users").send({ email: "b@example.com", name: "B", admin: true });
  assert.equal(res.status, 201);
  assert.equal(res.body.admin, undefined);
});