CVE-2026-117680

Name of the Vulnerable Software and Affected Versions jsv versions 0.1.0 through 0.26.1

Description An improper check for unusual or exceptional conditions in the pattern and patternProperties keywords allows an unauthenticated remote attacker to bypass schema validation. The function JSV.Helpers.RegexExt.bounded match?/2 executes schema regexes with a backtracking budget using :re.run/3 but fails to include :report errors. Consequently, when a match exhausts the budget, it returns :nomatch, which is indistinguishable from a genuine non-match. This allows a key matching a patternProperties regex to be checked against additionalProperties or skipped entirely, and allows strings that should be rejected by a not subschema with a pattern to be accepted. This occurs specifically in schemas where the regex explores a catastrophic branch before the matching branch. The attacker controls the input data, while linear patterns remain unaffected.

Recommendations Update jsv to version 0.26.2 or later. Pair patternProperties with additionalProperties: false to ensure keys that exhaust the budget are rejected. Write schema regexes without overlapping alternatives or nested quantifiers. Avoid using a not subschema with a pattern to express deny-lists on untrusted input.