What causes "Unsupported modifier: ${modName}" in FlowiseAI/Flowise?

Replace the unsupported modifier with a whitelisted one or drop it, e.g. `z.string().max(255)` instead of `z.string().email()`.

FlowiseAI/Flowise · error · Error

Unsupported modifier: ${modName}

Error message

Unsupported modifier: ${modName}

What it means

Thrown by SecureZodSchemaParser.extractTypeWithModifiers when a schema type string chains a modifier whose name is not in the parser's ALLOWED_TYPES whitelist (string, number, int, boolean, date, object, array, enum, optional, max, min, describe, default). The parser is deliberately restrictive and uses no eval/Function, so only those Zod method names are permitted after a dot. It exists to prevent arbitrary code execution from user-supplied schema strings.

Source

Thrown at packages/components/src/secureZodParser.ts:403

        if (!remainingPart.startsWith('.')) {
            return { arrayPart: typeStr, modifiers: [], hasModifiers: false }
        }

        // Parse modifiers
        const modifiers: any[] = []
        const modifierParts = remainingPart.substring(1).split('.')

        for (const part of modifierParts) {
            const modMatch = part.match(/^(\w+)(\(.*\))?$/)
            if (!modMatch) {
                throw new Error(`Invalid modifier: ${part}`)
            }

            const modName = modMatch[1]
            const modArgs = modMatch[2] ? this.parseArguments(modMatch[2]) : []

            if (!this.ALLOWED_TYPES.includes(modName)) {
                throw new Error(`Unsupported modifier: ${modName}`)
            }

            modifiers.push({ name: modName, args: modArgs })
        }

        return { arrayPart, modifiers, hasModifiers: true }
    }

    private static extractObjectWithModifiers(typeStr: string): { objectPart: string; modifiers: any[]; hasModifiers: boolean } {
        // Find the matching closing brace and parenthesis for z.object({...})
        let braceDepth = 0
        let parenDepth = 0
        let objectEndIndex = -1
        let startIndex = typeStr.indexOf('z.object(') + 8 // Position after "z.object"
        let foundOpenBrace = false

        for (let i = startIndex; i < typeStr.length; i++) {
            if (typeStr[i] === '{') {

View on GitHub (pinned to abe4a8601a)

Solutions

Replace the unsupported modifier with a whitelisted one or drop it, e.g. `z.string().max(255)` instead of `z.string().email()`.
Move format-level validation (email/uuid/regex) out of the schema string and into downstream validation after parsing.
Cross-check the schema tokens against ALLOWED_TYPES in packages/components/src/secureZodParser.ts:7 before submitting the schema.

Example fix

// before
const schema = "z.object({ email: z.string().email() })"
// after
const schema = "z.object({ email: z.string().max(255) })"

Defensive patterns

Strategy: validation

Validate before calling

const ALLOWED = ['string','number','int','boolean','date','object','array','enum','optional','max','min','describe','default']
function validateSchemaModifiers(schemaStr: string): string[] {
  const issues: string[] = []
  for (const m of schemaStr.matchAll(/\.([a-zA-Z_]\w*)\s*\(/g)) {
    if (!ALLOWED.includes(m[1])) issues.push(`unsupported modifier: ${m[1]}`)
  }
  return issues
}
// before calling SecureZodSchemaParser.parseZodSchema(schema):
const issues = validateSchemaModifiers(schema)
if (issues.length) throw new Error(issues.join('; '))

Type guard

function isWhitelistedModifier(name: string): boolean {
  return ['string','number','int','boolean','date','object','array','enum','optional','max','min','describe','default'].includes(name)
}

Try / catch

try {
  const schema = SecureZodSchemaParser.parseZodSchema(schemaStr)
} catch (e) {
  if (/Unsupported modifier/.test(e.message)) {
    // surface a user-friendly message listing allowed modifiers
  }
  throw e
}

Prevention

Only chain methods present in ALLOWED_TYPES when authoring schema strings.
Validate the schema string against the whitelist before persistence, not just at parse time.
Keep a documented subset of supported Zod methods for end users.

When it happens

Trigger: Any schema string whose dotted part is a non-whitelisted Zod method, e.g. `z.string().email()`, `z.string().url()`, `z.string().uuid()`, `z.string().regex(...)`, `z.number().positive()`. The part is split on '.', regex-captured via `^(\w+)($.*$)?$`, and the captured name is checked against ALLOWED_TYPES at secureZodParser.ts:402.

Common situations: Pasting a Zod schema from application code into a Flowise component's structured-output schema field; relying on Zod string formats (email/uuid/regex) or numeric refinements (positive/negative) that the secure parser intentionally omits.

Related errors

AI-assisted analysis of FlowiseAI/Flowise@abe4a8601a (2026-08-12). Data as JSON: /api/errors/09c78b31c9bf4453. Report an issue: GitHub.