Skip to content

fix: limit schema compilation depth - #874

Merged
ilteoood merged 2 commits into
mainfrom
fix/schema-depth-stack-exhaustion
Sep 17, 2026
Merged

ilteoood merged 2 commits into
mainfrom
fix/schema-depth-stack-exhaustion

Conversation

@mcollina

Copy link
Copy Markdown
Member

Summary

  • reject excessively nested schemas before recursive validation and code generation
  • apply depth accounting to inline, external, and reference-linked schemas, including validator-only keywords
  • detect circular object/reference graphs deterministically and walk validator dependencies iteratively
  • expose and document a bounded maxDepth option (default and maximum: 100)

Security

Fixes stack exhaustion during schema compilation reported in GHSA-2CPC-HGRF-32M6.

Validation

  • npm test (513 tests, 100% statement/branch/function/line coverage)
  • npm run lint
  • npm run test:typescript
  • reproduced the 718-level advisory PoC and confirmed it returns a controlled depth error instead of RangeError
  • exercised the highest accepted depth and first rejected depth across inline/reference-linked and eager/lazy validator paths

@Tony133 Tony133 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Comment thread index.js Outdated
Comment thread index.js Outdated
@Tony133

Tony133 commented Sep 5, 2026

Copy link
Copy Markdown
Member

@mcollina as soon as you have time, can you resolve the conflicts and answer the open questions?

@ilteoood
ilteoood self-requested a review September 17, 2026 17:18
@ilteoood
ilteoood enabled auto-merge (squash) September 17, 2026 17:19
@ilteoood
ilteoood merged commit 2baddc8 into main Sep 17, 2026
20 checks passed
@ilteoood
ilteoood deleted the fix/schema-depth-stack-exhaustion branch September 17, 2026 17:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants