z-schema 12.0.0 → 12.0.2

package/dist/format-validators.js

@@ -211,19 +211,55 @@ const uriTemplateValidator = (uri) => {
     }
     return !inExpression;
 };
+const hasValidTildeEscapes = (segment) => {
+    for (let i = 0; i < segment.length; i++) {
+        if (segment[i] === '~') {
+            const next = segment[i + 1];
+            if (next !== '0' && next !== '1') {
+                return false;
+            }
+            i++; // skip the escape character
+        }
+    }
+    return true;
+};
 const jsonPointerValidator = (pointer) => {
     if (typeof pointer !== 'string')
         return true;
     // JSON Pointer: empty, or a sequence of '/'-prefixed reference tokens.
     // In each token, '~' must be escaped as '~0' or '~1'.
-    return pointer === '' || /^(?:\/(?:[^~]|~0|~1)*)+$/.test(pointer);
+    if (pointer === '')
+        return true;
+    if (!/^(?:\/[^/]*)+$/.test(pointer))
+        return false;
+    const tokens = pointer.split('/').slice(1); // first element is empty before leading '/'
+    for (const token of tokens) {
+        if (!hasValidTildeEscapes(token))
+            return false;
+    }
+    return true;
 };
 const relativeJsonPointerValidator = (pointer) => {
     if (typeof pointer !== 'string')
         return true;
     // Relative JSON Pointer: non-negative integer prefix (no leading zeros unless zero),
     // followed by either '#', a JSON Pointer, or nothing.
-    return /^(?:0|[1-9]\d*)(?:#|(?:\/(?:[^~]|~0|~1)*)+)?$/.test(pointer);
+    const match = pointer.match(/^(0|[1-9]\d*)(.*)$/);
+    if (!match)
+        return false;
+    const suffix = match[2];
+    if (suffix === '' || suffix === '#')
+        return true;
+    if (!suffix.startsWith('/'))
+        return false;
+    if (!/^(?:\/[^/]*)+$/.test(suffix))
+        return false;
+    const tokens = suffix.split('/').slice(1);
+    for (const token of tokens) {
+        if (!hasValidTildeEscapes(token))
+            return false;
+    }
+    return true;
 };
 const timeValidator = (time) => {
     if (typeof time !== 'string')

package/dist/json-schema.js

@@ -6,8 +6,8 @@ import { getRemotePath, isAbsoluteUri } from './utils/uri.js';
 export const NON_SCHEMA_KEYWORDS = ['enum', 'const', 'default', 'examples'];
 /** Returns true if the key is an internal z-schema property (prefixed with `__$`). */
 export const isInternalKey = (key) => key.startsWith('__$');
+import { DEFAULT_MAX_RECURSION_DEPTH } from './utils/constants.js';
 import { isObject } from './utils/what-is.js';
-import { DEFAULT_MAX_RECURSION_DEPTH } from './z-schema-options.js';
 export const getId = (schema) => {
     // Draft-04 uses `id` exclusively — never return `$id` for a draft-04 schema
     if (typeof schema.$schema === 'string' && schema.$schema.includes('draft-04')) {

package/dist/report.js

@@ -1,9 +1,11 @@
 import { Errors, getValidateError } from './errors.js';
 import { shallowClone } from './utils/clone.js';
+import { MAX_ASYNC_TIMEOUT } from './utils/constants.js';
 import { get } from './utils/json.js';
 import { jsonSymbol, schemaSymbol } from './utils/symbols.js';
 import { isAbsoluteUri } from './utils/uri.js';
 import { isObject } from './utils/what-is.js';
+const ASYNC_TIMEOUT_POLL_MS = 10;
 export class Report {
     asyncTasks = [];
     commonErrorMessage;
@@ -77,7 +79,8 @@ export class Report {
         return this.parentReport.getAncestor(id);
     }
     processAsyncTasks(timeout, callback) {
-        const validationTimeout = timeout || 2000;
+        const validationTimeout = Math.min(Math.max(timeout || 2000, 0), MAX_ASYNC_TIMEOUT);
+        const timeoutAt = Date.now() + validationTimeout;
         let tasksCount = this.asyncTasks.length;
         let timedOut = false;
         const finish = () => {
@@ -106,13 +109,19 @@ export class Report {
             const respondCallback = respond(processFn);
             fn(...fnArgs, respondCallback);
         }
-        setTimeout(() => {
-            if (tasksCount > 0) {
+        const checkTimeout = () => {
+            if (timedOut || tasksCount <= 0) {
+                return;
+            }
+            if (Date.now() >= timeoutAt) {
                 timedOut = true;
                 this.addError('ASYNC_TIMEOUT', [tasksCount, validationTimeout]);
                 callback(getValidateError({ details: this.errors }), false);
+                return;
             }
-        }, validationTimeout);
+            setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
+        };
+        setTimeout(checkTimeout, ASYNC_TIMEOUT_POLL_MS);
     }
     getPath(returnPathAsString) {
         let path = [];

package/dist/schema-cache.js

@@ -4,6 +4,17 @@ import { deepClone } from './utils/clone.js';
 import { decodeJSONPointer } from './utils/json.js';
 import { getQueryPath, getRemotePath, isAbsoluteUri } from './utils/uri.js';
 import { normalizeOptions } from './z-schema-options.js';
+// Normalize a URI into a cache key, rejecting keys that could pollute Object.prototype.
+function getSafeRemotePath(uri) {
+    const remotePath = getRemotePath(uri);
+    if (!remotePath) {
+        return undefined;
+    }
+    if (remotePath === '__proto__' || remotePath === 'constructor' || remotePath === 'prototype') {
+        return undefined;
+    }
+    return remotePath;
+}
 const getEffectiveId = (schema) => {
     let id = getId(schema);
     if ((!id || !isAbsoluteUri(id)) && typeof schema.id === 'string' && isAbsoluteUri(schema.id)) {
@@ -34,31 +45,31 @@ export function prepareRemoteSchema(schema, uri, validationOptions, maxCloneDept
 }
 export class SchemaCache {
     validator;
-    static global_cache = {};
-    cache = {};
+    static global_cache = Object.create(null);
+    cache = Object.create(null);
     constructor(validator) {
         this.validator = validator;
     }
     static cacheSchemaByUri(uri, schema) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         if (remotePath) {
             this.global_cache[remotePath] = schema;
         }
     }
     cacheSchemaByUri(uri, schema) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         if (remotePath) {
             this.cache[remotePath] = schema;
         }
     }
     removeFromCacheByUri(uri) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         if (remotePath) {
             delete this.cache[remotePath];
         }
     }
     checkCacheForUri(uri) {
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         return remotePath ? this.cache[remotePath] != null : false;
     }
     getSchema(report, refOrSchema) {
@@ -73,6 +84,9 @@ export class SchemaCache {
         return deepClone(refOrSchema, this.validator.options.maxRecursionDepth);
     }
     fromCache(path) {
+        if (path === '__proto__' || path === 'constructor' || path === 'prototype') {
+            return undefined;
+        }
         let found = this.cache[path];
         if (found) {
             return found;
@@ -104,7 +118,7 @@ export class SchemaCache {
                 }
             }
         }
-        const remotePath = getRemotePath(uri);
+        const remotePath = getSafeRemotePath(uri);
         const queryPath = getQueryPath(uri);
         let result;
         let resolvedFromAncestor = false;

package/dist/schema-compiler.js

@@ -1,8 +1,23 @@
 import { getId, isInternalKey, NON_SCHEMA_KEYWORDS } from './json-schema.js';
 import { Report } from './report.js';
+import { DEFAULT_MAX_RECURSION_DEPTH } from './utils/constants.js';
 import { getRemotePath, isAbsoluteUri } from './utils/uri.js';
-import { DEFAULT_MAX_RECURSION_DEPTH } from './z-schema-options.js';
 import { getSchemaReader } from './z-schema-reader.js';
+/** Safely assign a property on `obj`, refusing prototype-polluting keys. */
+function safeSetProperty(obj, key, value) {
+    const unsafeTargets = [
+        Object.prototype,
+        Function.prototype,
+        Array.prototype,
+    ];
+    if (unsafeTargets.includes(obj)) {
+        return;
+    }
+    /** Reject property names that could pollute Object.prototype (CWE-1321). */
+    if (key !== '__proto__' && key !== 'constructor' && key !== 'prototype') {
+        obj[key] = value;
+    }
+}
 export const collectIds = (obj, maxDepth = DEFAULT_MAX_RECURSION_DEPTH) => {
     const ids = [];
     function walk(node, scope, _depth = 0) {
@@ -168,7 +183,8 @@ const resolveReference = (base, ref) => {
     }
     let baseDir = baseNoFrag;
     if (!baseDir.endsWith('/')) {
-        baseDir = baseDir.replace(/[^/]*$/, '');
+        const lastSlash = baseDir.lastIndexOf('/');
+        baseDir = lastSlash === -1 ? '' : baseDir.slice(0, lastSlash + 1);
     }
     return baseDir + ref;
 };
@@ -239,8 +255,14 @@ export class SchemaCompiler {
                 this.collectAndCacheIds(schema);
             }
         }
+        const canMutateSchemaObject = schema !== Object.prototype &&
+            schema !== Function.prototype &&
+            schema !== Array.prototype;
         // if we have an id than it should be cached already (if this instance has compiled it)
-        if (schema.__$compiled && schema.id && this.validator.scache.checkCacheForUri(schema.id) === false) {
+        if (canMutateSchemaObject &&
+            schema.__$compiled &&
+            schema.id &&
+            this.validator.scache.checkCacheForUri(schema.id) === false) {
             schema.__$compiled = undefined;
         }
         // do not re-compile schemas
@@ -248,7 +270,7 @@ export class SchemaCompiler {
             return true;
         }
         // v8 - if $schema is not present, set $schema to default
-        if (!schema.$schema && this.validator.options.version !== 'none') {
+        if (canMutateSchemaObject && !schema.$schema && this.validator.options.version !== 'none') {
             schema.$schema = this.validator.getDefaultSchemaId();
         }
         if (schema.id && typeof schema.id === 'string' && !options?.noCache) {
@@ -263,7 +285,9 @@ export class SchemaCompiler {
         }
         // delete all __$missingReferences from previous compilation attempts
         const isValidExceptReferences = report.isValid();
-        delete schema.__$missingReferences;
+        if (canMutateSchemaObject) {
+            delete schema.__$missingReferences;
+        }
         // collect all references that need to be resolved - $ref and $schema
         const useRefObjectScope = this.validator.options.version === 'draft2019-09' || this.validator.options.version === 'draft2020-12';
         const refs = collectReferences(schema, undefined, undefined, undefined, { useRefObjectScope }, this.validator.options.maxRecursionDepth);
@@ -317,17 +341,17 @@ export class SchemaCompiler {
                     report.addError('UNRESOLVABLE_REFERENCE', [refObj.ref]);
                     report.path = report.path.slice(0, -refObj.path.length);
                     // pusblish unresolved references out
-                    if (isValidExceptReferences) {
+                    if (isValidExceptReferences && canMutateSchemaObject) {
                         schema.__$missingReferences = schema.__$missingReferences || [];
                         schema.__$missingReferences.push(refObj);
                     }
                 }
             }
             // this might create circular references
-            refObj.obj[`__${refObj.key}Resolved`] = response;
+            safeSetProperty(refObj.obj, `__${refObj.key}Resolved`, response);
         }
         const isValid = report.isValid();
-        if (isValid) {
+        if (isValid && canMutateSchemaObject) {
             schema.__$compiled = true;
         }
         // else {
@@ -360,7 +384,7 @@ export class SchemaCompiler {
                         const response = arr.find((x) => x.id === refObj.ref);
                         if (response) {
                             // this might create circular references
-                            refObj.obj[`__${refObj.key}Resolved`] = response;
+                            safeSetProperty(refObj.obj, `__${refObj.key}Resolved`, response);
                             // it's resolved now so delete it
                             sch.__$missingReferences.splice(idx2, 1);
                         }

package/dist/types/utils/constants.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Default maximum recursion depth for deeply nested schema/data traversal.
+ * Used as the default for {@link ZSchemaOptions.maxRecursionDepth} and
+ * internal helpers like `deepClone` and `collectIds`.
+ */
+export declare const DEFAULT_MAX_RECURSION_DEPTH = 100;
+/**
+ * Maximum allowed value for {@link ZSchemaOptions.asyncTimeout} in milliseconds.
+ * Values exceeding this limit are clamped during option normalization to
+ * prevent resource exhaustion (CWE-400).
+ */
+export declare const MAX_ASYNC_TIMEOUT = 60000;
+/**
+ * Maximum allowed length for a JSON Schema `pattern` regular expression string.
+ * Patterns exceeding this limit are rejected by {@link compileSchemaRegex} to
+ * mitigate Regular Expression Denial-of-Service (CWE-1333) and regex injection
+ * (CWE-95).
+ */
+export declare const MAX_SCHEMA_REGEX_LENGTH = 10000;

package/dist/types/z-schema-base.d.ts

@@ -1,8 +1,9 @@
 import type { ValidateError } from './errors.js';
 import type { FormatValidatorFn } from './format-validators.js';
-import type { JsonSchema } from './json-schema-versions.js';
+import type { JsonSchema, JsonSchemaInternal } from './json-schema-versions.js';
 import type { ZSchemaOptions } from './z-schema-options.js';
 import { type Errors } from './errors.js';
+import { Report } from './report.js';
 import { SchemaCache } from './schema-cache.js';
 import { SchemaCompiler } from './schema-compiler.js';
 import { SchemaValidator } from './schema-validator.js';
@@ -28,6 +29,14 @@ export declare class ZSchemaBase {
     validateOptions: ValidateOptions;
     options: ZSchemaOptions;
     constructor(options: ZSchemaOptions | undefined, token: symbol);
+    /**
+     * Internal recursive JSON validation — delegates to the `validate` function
+     * in `json-validation.ts`. Exposed as a method so that per-keyword validator
+     * modules (array, combinators, object) can call back into the core validator
+     * via `this` without importing `json-validation.ts` directly (which would
+     * create a circular dependency).
+     */
+    _jsonValidate(report: Report, schema: boolean | JsonSchemaInternal, json: unknown): boolean;
     getDefaultSchemaId(): string;
     _validate(json: unknown, schema: JsonSchema | string, options: ValidateOptions, callback: ValidateCallback): void;
     _validate(json: unknown, schema: JsonSchema | string, callback: ValidateCallback): void;

package/dist/types/z-schema-options.d.ts

@@ -1,7 +1,8 @@
 import type { FormatValidatorFn } from './format-validators.js';
 import type { Report } from './report.js';
 import { type JsonSchemaVersion } from './json-schema-versions.js';
-export declare const DEFAULT_MAX_RECURSION_DEPTH = 100;
+import { DEFAULT_MAX_RECURSION_DEPTH, MAX_ASYNC_TIMEOUT } from './utils/constants.js';
+export { DEFAULT_MAX_RECURSION_DEPTH, MAX_ASYNC_TIMEOUT };
 export interface ZSchemaOptions {
     version?: JsonSchemaVersion | 'none';
     asyncTimeout?: number;

package/dist/utils/clone.js

@@ -1,4 +1,4 @@
-import { DEFAULT_MAX_RECURSION_DEPTH } from '../z-schema-options.js';
+import { DEFAULT_MAX_RECURSION_DEPTH } from './constants.js';
 import { copyProp } from './properties.js';
 export const shallowClone = (src) => {
     if (src == null || typeof src !== 'object') {

package/dist/utils/constants.js

@@ -0,0 +1,19 @@
+/**
+ * Default maximum recursion depth for deeply nested schema/data traversal.
+ * Used as the default for {@link ZSchemaOptions.maxRecursionDepth} and
+ * internal helpers like `deepClone` and `collectIds`.
+ */
+export const DEFAULT_MAX_RECURSION_DEPTH = 100;
+/**
+ * Maximum allowed value for {@link ZSchemaOptions.asyncTimeout} in milliseconds.
+ * Values exceeding this limit are clamped during option normalization to
+ * prevent resource exhaustion (CWE-400).
+ */
+export const MAX_ASYNC_TIMEOUT = 60_000;
+/**
+ * Maximum allowed length for a JSON Schema `pattern` regular expression string.
+ * Patterns exceeding this limit are rejected by {@link compileSchemaRegex} to
+ * mitigate Regular Expression Denial-of-Service (CWE-1333) and regex injection
+ * (CWE-95).
+ */
+export const MAX_SCHEMA_REGEX_LENGTH = 10_000;

package/dist/utils/json.js

@@ -1,4 +1,4 @@
-import { DEFAULT_MAX_RECURSION_DEPTH } from '../z-schema-options.js';
+import { DEFAULT_MAX_RECURSION_DEPTH } from './constants.js';
 import { isObject } from './what-is.js';
 export const areEqual = (json1, json2, options, _depth = 0) => {
     const caseInsensitiveComparison = options?.caseInsensitiveComparison || false;

package/dist/utils/schema-regex.js

@@ -1,6 +1,16 @@
 // Shared regex compilation helper for JSON Schema patterns
 // Returns { ok: true, value: RegExp } or { ok: false, error: { pattern, message } }
+import { MAX_SCHEMA_REGEX_LENGTH } from './constants.js';
 export function compileSchemaRegex(pattern) {
+    if (pattern.length > MAX_SCHEMA_REGEX_LENGTH) {
+        return {
+            ok: false,
+            error: {
+                pattern,
+                message: `Pattern length ${pattern.length} exceeds maximum allowed length of ${MAX_SCHEMA_REGEX_LENGTH}`,
+            },
+        };
+    }
     const unicodePropertyEscape = /\\[pP]{/;
     const nonBmpCharacter = /[\u{10000}-\u{10FFFF}]/u;
     const surrogatePairEscape = /\\uD[89AB][0-9A-Fa-f]{2}\\uD[CDEF][0-9A-Fa-f]{2}/;
@@ -9,6 +19,7 @@ export function compileSchemaRegex(pattern) {
     if (needsUnicode) {
         // Try compiling with 'u' flag only
         try {
+            // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
             const re = new RegExp(pattern, 'u');
             return { ok: true, value: re };
         }
@@ -24,6 +35,7 @@ export function compileSchemaRegex(pattern) {
     }
     else {
         try {
+            // lgtm[js/regex-injection] JSON Schema `pattern` is intentionally regex syntax and constrained by MAX_SCHEMA_REGEX_LENGTH.
             const re = new RegExp(pattern);
             return { ok: true, value: re };
         }

package/dist/validation/array.js

@@ -1,4 +1,3 @@
-import { validate } from '../json-validation.js';
 import { isUniqueArray } from '../utils/array.js';
 import { cacheValidationResult, deferOrRunSync, shouldSkipValidate } from './shared.js';
 // ---------------------------------------------------------------------------
@@ -100,7 +99,7 @@ export function containsValidator(report, schema, json) {
     for (let idx = 0; idx < json.length; idx++) {
         const subReport = new Report_(report);
         subReports.push(subReport);
-        validate.call(this, subReport, containsSchema, json[idx]);
+        this._jsonValidate(subReport, containsSchema, json[idx]);
         cacheValidationResult(report, containsSchema, json[idx], subReport.errors.length === 0);
     }
     const addContainsErrorIfNeeded = () => {

package/dist/validation/combinators.js

@@ -1,4 +1,3 @@
-import { validate } from '../json-validation.js';
 import { Report } from '../report.js';
 import { cacheValidationResult, deferOrRunSync } from './shared.js';
 // ---------------------------------------------------------------------------
@@ -7,7 +6,7 @@ import { cacheValidationResult, deferOrRunSync } from './shared.js';
 export function allOfValidator(report, schema, json) {
     // http://json-schema.org/latest/json-schema-validation.html#rfc.section.5.5.3.2
     for (let i = 0; i < schema.allOf.length; i++) {
-        const validateResult = validate.call(this, report, schema.allOf[i], json);
+        const validateResult = this._jsonValidate(report, schema.allOf[i], json);
         if (this.options.breakOnFirstError && validateResult === false) {
             break;
         }
@@ -22,7 +21,7 @@ export function anyOfValidator(report, schema, json) {
     for (let i = 0; i < schema.anyOf.length; i++) {
         const subReport = new Report(report);
         subReports.push(subReport);
-        validate.call(this, subReport, schema.anyOf[i], json);
+        this._jsonValidate(subReport, schema.anyOf[i], json);
         cacheValidationResult(report, schema.anyOf[i], json, subReport.errors.length === 0);
     }
     // Aggregate async tasks and decide when ready
@@ -48,7 +47,7 @@ export function oneOfValidator(report, schema, json) {
     for (let i = 0; i < schema.oneOf.length; i++) {
         const subReport = new Report(report);
         subReports.push(subReport);
-        validate.call(this, subReport, schema.oneOf[i], json);
+        this._jsonValidate(subReport, schema.oneOf[i], json);
         cacheValidationResult(report, schema.oneOf[i], json, subReport.errors.length === 0);
     }
     // Aggregate async tasks and decide when ready
@@ -73,7 +72,7 @@ export function oneOfValidator(report, schema, json) {
 export function notValidator(report, schema, json) {
     // http://json-schema.org/latest/json-schema-validation.html#rfc.section.5.5.6.2
     const subReport = new Report(report);
-    if (validate.call(this, subReport, schema.not, json) === true) {
+    if (this._jsonValidate(subReport, schema.not, json) === true) {
         report.addError('NOT_PASSED', undefined, undefined, schema, 'not');
     }
 }
@@ -91,13 +90,13 @@ export function ifValidator(report, schema, json) {
         return;
     }
     const conditionReport = new Report(report);
-    validate.call(this, conditionReport, conditionSchema, json);
+    this._jsonValidate(conditionReport, conditionSchema, json);
     cacheValidationResult(report, conditionSchema, json, conditionReport.errors.length === 0);
     const branchSchema = conditionReport.errors.length === 0 ? thenSchema : elseSchema;
     if (branchSchema === undefined) {
         return;
     }
-    validate.call(this, report, branchSchema, json);
+    this._jsonValidate(report, branchSchema, json);
 }
 export function thenValidator() {
     // handled by if

package/dist/validation/object.js

@@ -1,4 +1,3 @@
-import { validate } from '../json-validation.js';
 import { difference } from '../utils/array.js';
 import { compileSchemaRegex } from '../utils/schema-regex.js';
 import { isObject } from '../utils/what-is.js';
@@ -153,7 +152,7 @@ export function dependenciesValidator(report, schema, json) {
             }
             else {
                 // if dependency is a schema, validate against this schema
-                validate.call(this, report, dependencyDefinition, json);
+                this._jsonValidate(report, dependencyDefinition, json);
             }
         }
     }
@@ -172,7 +171,7 @@ export function dependentSchemasValidator(report, schema, json) {
     for (const dependencyName of keys) {
         if (Object.hasOwn(json, dependencyName)) {
             const dependencySchema = schema.dependentSchemas[dependencyName];
-            validate.call(this, report, dependencySchema, json);
+            this._jsonValidate(report, dependencySchema, json);
         }
     }
 }
@@ -225,7 +224,7 @@ export function propertyNamesValidator(report, schema, json) {
     for (const key of keys) {
         const subReport = new Report_(report);
         subReports.push(subReport);
-        validate.call(this, subReport, propertyNamesSchema, key);
+        this._jsonValidate(subReport, propertyNamesSchema, key);
     }
     const addPropertyNameErrors = () => {
         for (let idx = 0; idx < keys.length; idx++) {

package/dist/validation/string.js

@@ -93,21 +93,13 @@ export function formatValidator(report, schema, json) {
             const result = formatValidatorFn.call(this, json);
             if (result instanceof Promise) {
                 // Promise-based async
-                const timeoutMs = this.options.asyncTimeout || 2000;
                 const promiseResult = result;
                 report.addAsyncTaskWithPath(async (callback) => {
                     try {
-                        const timeoutPromise = new Promise((_, reject) => {
-                            setTimeout(() => reject(new Error('Async timeout')), timeoutMs);
-                        });
-                        const resolved = await Promise.race([promiseResult, timeoutPromise]);
+                        const resolved = await promiseResult;
                         callback(resolved);
                     }
-                    catch (error) {
-                        if (error.message === 'Async timeout') {
-                            // Don't call callback, let global timeout handle it
-                            return;
-                        }
+                    catch (_error) {
                         callback(false);
                     }
                 }, [], function (resolvedResult) {

package/dist/z-schema-base.js

@@ -33,6 +33,16 @@ export class ZSchemaBase {
         this.sv = new SchemaValidator(this);
         this.options = normalizeOptions(options);
     }
+    /**
+     * Internal recursive JSON validation — delegates to the `validate` function
+     * in `json-validation.ts`. Exposed as a method so that per-keyword validator
+     * modules (array, combinators, object) can call back into the core validator
+     * via `this` without importing `json-validation.ts` directly (which would
+     * create a circular dependency).
+     */
+    _jsonValidate(report, schema, json) {
+        return validateJson.call(this, report, schema, json);
+    }
     getDefaultSchemaId() {
         return this.options.version && this.options.version !== 'none'
             ? VERSION_SCHEMA_URL_MAPPING[this.options.version]

package/dist/z-schema-options.js

@@ -1,6 +1,7 @@
 import { CURRENT_DEFAULT_SCHEMA_VERSION } from './json-schema-versions.js';
 import { shallowClone } from './utils/clone.js';
-export const DEFAULT_MAX_RECURSION_DEPTH = 100;
+import { DEFAULT_MAX_RECURSION_DEPTH, MAX_ASYNC_TIMEOUT } from './utils/constants.js';
+export { DEFAULT_MAX_RECURSION_DEPTH, MAX_ASYNC_TIMEOUT };
 export const defaultOptions = {
     // default version to validate against
     version: CURRENT_DEFAULT_SCHEMA_VERSION,
@@ -80,6 +81,10 @@ export const normalizeOptions = (options) => {
     else {
         normalized = shallowClone(defaultOptions);
     }
+    // Clamp asyncTimeout to prevent resource exhaustion (CWE-400)
+    if (normalized.asyncTimeout != null) {
+        normalized.asyncTimeout = Math.min(Math.max(normalized.asyncTimeout, 0), MAX_ASYNC_TIMEOUT);
+    }
     if (normalized.strictMode === true) {
         normalized.forceAdditional = true;
         normalized.forceItems = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "z-schema",
-  "version": "12.0.0",
+  "version": "12.0.2",
   "engines": {
     "node": ">=22.0.0"
   },
@@ -74,6 +74,8 @@
     "build:tests": "tsc --noEmit --project test/tsconfig.json",
     "copy:module-json": "node -e \"fs.copyFileSync('./src/package.json', './dist/package.json')\"",
     "copy:schemas": "node ./scripts/copy-schemas.mts",
+    "coverage:artifacts": "node ./scripts/generate-test-coverage-report.mts",
+    "coverage:update-badge": "node ./scripts/update-readme-coverage-badge.mts",
     "prepublishOnly": "npm run clean && npm run build && npm test",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",

package/src/format-validators.ts

@@ -241,18 +241,47 @@ const uriTemplateValidator: FormatValidatorFn = (uri: unknown) => {
   return !inExpression;
 };
 
+const hasValidTildeEscapes = (segment: string): boolean => {
+  for (let i = 0; i < segment.length; i++) {
+    if (segment[i] === '~') {
+      const next = segment[i + 1];
+      if (next !== '0' && next !== '1') {
+        return false;
+      }
+      i++; // skip the escape character
+    }
+  }
+  return true;
+};
+
 const jsonPointerValidator: FormatValidatorFn = (pointer: unknown) => {
   if (typeof pointer !== 'string') return true;
   // JSON Pointer: empty, or a sequence of '/'-prefixed reference tokens.
   // In each token, '~' must be escaped as '~0' or '~1'.
-  return pointer === '' || /^(?:\/(?:[^~]|~0|~1)*)+$/.test(pointer);
+  if (pointer === '') return true;
+  if (!/^(?:\/[^/]*)+$/.test(pointer)) return false;
+  const tokens = pointer.split('/').slice(1); // first element is empty before leading '/'
+  for (const token of tokens) {
+    if (!hasValidTildeEscapes(token)) return false;
+  }
+  return true;
 };
 
 const relativeJsonPointerValidator: FormatValidatorFn = (pointer: unknown) => {
   if (typeof pointer !== 'string') return true;
   // Relative JSON Pointer: non-negative integer prefix (no leading zeros unless zero),
   // followed by either '#', a JSON Pointer, or nothing.
-  return /^(?:0|[1-9]\d*)(?:#|(?:\/(?:[^~]|~0|~1)*)+)?$/.test(pointer);
+  const match = pointer.match(/^(0|[1-9]\d*)(.*)$/);
+  if (!match) return false;
+  const suffix = match[2];
+  if (suffix === '' || suffix === '#') return true;
+  if (!suffix.startsWith('/')) return false;
+  if (!/^(?:\/[^/]*)+$/.test(suffix)) return false;
+  const tokens = suffix.split('/').slice(1);
+  for (const token of tokens) {
+    if (!hasValidTildeEscapes(token)) return false;
+  }
+  return true;
 };
 
 const timeValidator: FormatValidatorFn = (time: unknown) => {