
Security News
Next.js Patches Critical Middleware Vulnerability (CVE-2025-29927)
Next.js has patched a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
@stoplight/spectral
Advanced tools
A flexible object linter with out of the box support for OpenAPI v2 and v3.
A flexible JSON linter with out of the box support for OpenAPI v2 and v3.
npm install -g @stoplight/spectral
# OR
yarn global add @stoplight/spectral
For more installation options, see Getting Started > Installation
After installation take a look at our getting started documentation.
Ajv is a JSON Schema validator, and Spectral is a JSON/YAML linter. Instead of just validating against JSON Schema, it can be used to write rules for any sort of JSON/YAML object, which could be JSON Schema, or OpenAPI, or anything similar. Spectral does expose a schema
function that you can use in your rules to validate all or part of the target object with JSON Schema (we even use Ajv used under the hood for this), but that's just one of many functions.
No problem! A hosted version of Spectral comes free with the Stoplight platform. Sign up for a free account here.
Speccy was a great inspiration for Spectral, but was designed to work only with OpenAPI v3. Spectral can apply rules to any JSON/YAML object (including OpenAPI v2 and v3) through the use of JSONPath given
parameters. Some rule types have been enhanced to be a little more flexible along with being able to create your own rules based on the built-in functions, and we've added the ability to define custom functions too.
If you are interested in contributing to Spectral itself, check out our contributing docs to get started.
If you are using Spectral in your project and want to be listed in the examples section, we encourage you to open an issue.
given
path you wantgetJsonPathForPosition
or getLocationForJsonPath
If you have a bug or feature request, please create an issue.
If you need help using Spectral or have a support question, please use the Stoplight Community forum. We've created an open source category for these questions. It's also a great place to share your implementations.
If you want to discuss something in private, you can reach out to Stoplight support at support@stoplight.io.
FAQs
[](https://stoplight.io/api-governance?utm_source=github&utm_medium=spectral&utm_campaign=readme) [ that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
Security News
A survey of 500 cybersecurity pros reveals high pay isn't enough—lack of growth and flexibility is driving attrition and risking organizational security.
Product
Socket, the leader in open source security, is now available on Google Cloud Marketplace for simplified procurement and enhanced protection against supply chain attacks.