Request validation with Zod in Express

Express does not validate request input for you. Without a check at the edge, handlers get raw req.body , req.query , and req.params - strings where you expected numbers, missing fields, and shapes that only blow up deep in business logic. Zod is a TypeScript-first schema library. You declare the shape once, infer types with z.infer , and parse at the HTTP boundary so route handlers only see valid data. Invalid input becomes HTTP 400 before your code runs. This post covers Zod 4 schemas ( z.email() , z.uuid() , z.coerce ), Express validation middleware, error formatting and pitfalls. Prerequisites Node.js version 26 Zod 4: npm i zod Express: npm i express and npm i -D @types/express Zod 3 method forms like z.string().email() still work but are deprecated in v4. Prefer the top-level APIs below. Schemas // schemas.ts import { z } from ' zod ' ; export const createUserSchema = z . object ({ email : z . email (), name : z . string (). min ( 1 ). max ( 100 ), age : z . number (). int (). min ( 0 ). max ( 150 ). optional () }); export type CreateUserInput = z . infer < typeof createUserSchema > ; export const userIdParamSchema = z . object ({ id : z . uuid () }); export const listUsersQuerySchema = z . object ({ limit : z . coerce . number (). int (). min ( 1 ). max ( 100 ). default ( 10 ), q : z . string (). trim (). min ( 1 ). optional () }); z.coerce.number() is useful for query strings - HTTP query values arrive as strings. Prefer safeParse over parse at the edge so you control the HTTP status and response body. Format errors once Map ZodError.issues into a stable JSON body, or use Zod 4 helpers z.flattenError() / z.treeifyError() when you want field-keyed or nested shapes. // format-zod-error.ts import { ZodError } from ' zod ' ; export function formatZodError ( error : ZodError ) { return { message : ' Validation failed ' , issues : error . issues . map (( issue ) => ({ path : issue . path . join ( ' . ' ) || ' (root) ' , message : issue . message , code : issue . c