AIKIDO-2026-10449
z-schema is vulnerable to Regular Expression Denial-of-service (ReDoS)
55
Medium Risk
This Affects:
z-schemaTL;DR
Affected versions of z-schema are vulnerable to a Regular Expression Denial of Service (ReDoS) due to unsafe regular expression handling in schema pattern validation. The implementation evaluates user-controlled schema patterns without verifying whether the supplied regex is safe, allowing crafted expressions with catastrophic backtracking to trigger excessive CPU consumption during validation. This may lead to application-level denial of service when processing malicious schemas or data.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
z-schema is vulnerable to Regular Expression Denial-of-service (ReDoS) in versions 7.1.0 - 12.0.4.
How to fix this
Upgrade the z-schema library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.