If you discover a security vulnerability, please report it privately via GitHub Security Advisories rather than opening a public issue.

You should receive a response within a week. If accepted, a fix will be prioritized and released as a patch version.

Regex denial-of-service: The pattern and patternProperties keywords use mvzr, a backtracking regex engine. Pathological patterns (e.g. (a+)+$) can cause exponential matching time. This is only a concern if untrusted users supply schemas — not if untrusted users supply data validated against trusted schemas. See the README for mitigation strategies.