fix(fromJSONSchema): normalize input via JSON round-trip

`fromJSONSchema` previously stack-overflowed on cyclic JS object inputs
(e.g. dereferenced JSON Schemas where `$ref` strings have been replaced
with live object references) and on inputs with infinite-loop-on-access
getters or Proxies. JSON Schema is JSON, and JSON has no cycles — these
inputs are off-spec.

Round-trip the input through `JSON.parse(JSON.stringify(...))` at the
top of `fromJSONSchema`. Cyclic and otherwise non-JSON inputs throw a
clear error. Getter/Proxy properties are materialized into static values
and class instances collapse to plain objects, so the rest of the
converter only ever walks a finite, plain object graph.

Closes #5675.

Author: colinhacks

packages/zod/src/v4/classic/from-json-schema.ts

@@ -632,17 +632,28 @@ export function fromJSONSchema(schema: JSONSchema.JSONSchema | boolean, params?:
     return schema ? z.any() : z.never();
   }
 
-  const version = detectVersion(schema, params?.defaultTarget);
-  const defs = (schema.$defs || schema.definitions || {}) as Record<string, JSONSchema.JSONSchema>;
+  // Normalize input via a JSON round-trip. This guarantees the converter
+  // walks a plain, finite, JSON-valid object graph: cyclic inputs fail here,
+  // getter/Proxy-based properties are materialized into static values, and
+  // class instances collapse to plain objects.
+  let normalized: JSONSchema.JSONSchema;
+  try {
+    normalized = JSON.parse(JSON.stringify(schema));
+  } catch {
+    throw new Error("fromJSONSchema input is not valid JSON (possibly cyclic); use $defs/$ref for recursive schemas");
+  }
+
+  const version = detectVersion(normalized, params?.defaultTarget);
+  const defs = (normalized.$defs || normalized.definitions || {}) as Record<string, JSONSchema.JSONSchema>;
 
   const ctx: ConversionContext = {
     version,
     defs,
     refs: new Map(),
     processing: new Set(),
-    rootSchema: schema,
+    rootSchema: normalized,
     registry: params?.registry ?? globalRegistry,
   };
 
-  return convertSchema(schema, ctx);
+  return convertSchema(normalized, ctx);
 }

packages/zod/src/v4/classic/tests/from-json-schema.test.ts

@@ -839,3 +839,57 @@ test("description and unrecognized metadata coexist on the same schema", () => {
   expect(schema.description).toBe("A custom string");
   expect(customRegistry.get(schema)?.["x-custom"]).toBe("value");
 });
+
+test("circular input throws a clear error", () => {
+  const person: any = {
+    type: "object",
+    properties: { name: { type: "string" } },
+    required: ["name"],
+  };
+  person.properties.bestFriend = person;
+  expect(() => fromJSONSchema(person)).toThrow(/not valid JSON/);
+});
+
+test("getter-based input that synthesizes a cycle throws", () => {
+  const root: any = { type: "object", properties: { name: { type: "string" } } };
+  Object.defineProperty(root.properties, "self", {
+    enumerable: true,
+    get() {
+      return root;
+    },
+  });
+  expect(() => fromJSONSchema(root)).toThrow(/not valid JSON/);
+});
+
+test("BigInt in input throws", () => {
+  const input: any = { type: "integer", minimum: 1n };
+  expect(() => fromJSONSchema(input)).toThrow(/not valid JSON/);
+});
+
+test("class-instance input is normalized to a plain object", () => {
+  class StringSchema {
+    type = "string" as const;
+    minLength = 2;
+  }
+  const schema = fromJSONSchema(new StringSchema() as any);
+  expect(schema.parse("hi")).toBe("hi");
+  expect(() => schema.parse("h")).toThrow();
+});
+
+test("getter-based properties are materialized", () => {
+  const input: any = { type: "object", properties: {}, required: [] };
+  Object.defineProperty(input.properties, "name", {
+    enumerable: true,
+    get() {
+      return { type: "string" };
+    },
+  });
+  const schema = fromJSONSchema(input);
+  expect(schema.parse({ name: "Alice" })).toEqual({ name: "Alice" });
+});
+
+test("Date default is coerced to its JSON string form", () => {
+  const date = new Date("2026-01-02T03:04:05.000Z");
+  const schema = fromJSONSchema({ type: "string", default: date as any });
+  expect(schema.parse(undefined)).toBe(date.toISOString());
+});