Vulnerabilities

Vulnerability · CVE-2026-117680

jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not

Published Nov 1, 2026 · catalog updated Nov 1, 2026 · jsv treats regex match

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-117680. EPSS is 0.19%. Act only if a listed version of jsv treats regex match is installed.

Severity

Low2.1

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.19%

Remediation

Advisory link

Affected products

Hex jsv

## Summary Improper Check for Unusual or Exceptional Conditions vulnerability in the and keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. runs schema regexes with a backtracking budget but calls without , so a match that exhausts the budget returns the same as a real non-match. A key that matches a regex is then checked against or not at all, and a string that matches a subschema with a is accepted. Before the budget existed, failed the same way at Erlang's default match limit. Only schemas whose regex explores a catastrophic branch before the branch that matches are affected. The attacker controls the data, not the schema, and linear patterns never exhaust the budget. This issue affects jsv: from 0.1.0 before 0.26.2. ## Details **1. Bounded matching.** in runs each schema regex through with and set to , capped at 10,000,000. The call omits , so PCRE's error is returned as . The function compares the result to and returns for a genuine non-match and for an exhausted budget alike. **2. Keyword evaluation.** uses the result for , and uses it to decide which subschemas apply to each key. The draft 7 vocabulary delegates to the same modules. A from an exhausted budget therefore means a keyword fails and a subschema is skipped. **3. Inversion by combinators.** Under , , , and , a failing subschema can make the parent succeed, so a false non-match under accepts a string the deny-list should reject. Under the skipped subschema means the value is checked against or nothing. **4. History.** Before the budget was introduced, the same keywords called , which also returns on Erlang's default limit of 10,000,000 steps. The budget lowered the input size needed from about 25 bytes to about 20 bytes for the advisory's pattern. ## Proof of concept 1. Build a schema with mapping the regex to . 2. Submit an object whose only key is twenty characters followed by and whose va