Threats affecting pkg:hex/jsv

CVE-2026-117680 is a low-severity vulnerability in the lud jsv library affecting versions from 0.1.0 up to but not including 0.26.2. It involves an improper check for unusual or exceptional conditions in schema validation related to regex backtracking limits. An unauthenticated remote attacker can bypass schema validation by exploiting regex patterns that cause heavy backtracking, leading to incorrect acceptance of invalid data. The issue is fixed in version 0.26.2.