How to validate Express request input using Zod 4 schemas and middleware

Express does not validate incoming request data by default, leaving handlers exposed to malformed or missing input that can cause errors deep in application logic. Zod, a TypeScript-first schema library, allows developers to define data shapes once and parse requests at the HTTP boundary before any business logic runs. Using Zod 4's top-level APIs such as z.email(), z.uuid(), and z.coerce, developers can validate request body, query parameters, and route params in a reusable Express middleware. Invalid requests are rejected with an HTTP 400 response and a structured error body before the route handler is ever reached. The approach uses safeParse for controlled error handling and stores coerced query and param data on res.locals to avoid conflicts with Express's built-in type definitions.