z.coerce.number() applies JavaScript's Number() to the input before validating. Number('') is 0, Number(null) is 0, Number(false) is 0, and Number([]) is 0, so all four pass a plain coerced number schema. This is present in both Zod 3 and Zod 4 and is a frequent source of bad data from HTML forms and query strings, where an untouched field arrives as an empty string.
The same class of problem applies to z.coerce.boolean(), which is Boolean(input) and therefore treats the string "false" as true. Any non-empty string coerces to true.
Guard the input before coercing rather than after. A pipeline such as z.string().min(1).pipe(z.coerce.number()) rejects the empty string first. For booleans from query parameters, validate the literal strings explicitly with z.enum(['true','false']).transform(v => v === 'true'). Reserve z.coerce for inputs whose type is genuinely uncertain and whose falsy forms are meaningful.