Improper Check for Unusual Conditions in lud jsv Product Vulnerability

CVE-2026-117680

What is CVE-2026-117680?

The vulnerability in the lud jsv product involves an improper validation mechanism in the pattern and patternProperties keywords. An unauthenticated remote attacker can exploit this flaw, allowing a crafted string that meets schema regex criteria to bypass validation entirely. This occurs due to the flawed handling of backtracking in regular expression matching, where the system inaccurately treats certain exhaustive matches as non-matches. As such, attackers can leverage the ability to manipulate data inputs while the schema remains intact, particularly affecting schemas that trigger catastrophic backtracking scenarios. This impacts versions of jsv from 0.1.0 to 0.26.1.

References