The answer
z.string().length(24) for a 24-char hex string (MongoDB ObjectId format). For stricter validation, use a regex: z.string().regex(/^[0-9a-fA-F]{24}$/). Zod will reject anything that does not match.
Input Validation With Zod in Express: A Complete Guide
How do I validate an ObjectId with Zod?
More FAQs in Input Validation With Zod in Express: A Complete Guide
Define a Zod schema, write a validate(schema) middleware factory that uses safeParse, returns 400 with errors if invalid, replaces req.body with parsed data if valid, and calls next. Apply per route: router.post('/signup', validate(signupSchema), signup).
TypeScript inference, great error messages, composable schemas, safe parse (returns success or error instead of throwing), and built-in types and transforms. It is one of the best modern validators for Node.js.
Use a separate factory that reads req.params. Example: const idSchema = z.object({ id: z.string().length(24) }); router.get('/users/:id', validateParams(idSchema), getUser). Validate query the same way with a validateQuery factory.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.