CVE-2025-69873

ajv: ReDoS via $data reference

View on CVE.org
Published Feb 11, 2026 CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Description
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:10093 cve-icon
https://access.redhat.com/errata/RHSA-2026:13512 cve-icon
https://access.redhat.com/errata/RHSA-2026:14774 cve-icon
https://access.redhat.com/errata/RHSA-2026:15091 cve-icon
https://access.redhat.com/errata/RHSA-2026:16874 cve-icon
https://access.redhat.com/errata/RHSA-2026:19712 cve-icon
https://access.redhat.com/errata/RHSA-2026:26211 cve-icon
https://access.redhat.com/errata/RHSA-2026:26214 cve-icon
https://access.redhat.com/errata/RHSA-2026:33371 cve-icon
https://access.redhat.com/errata/RHSA-2026:36651 cve-icon
https://access.redhat.com/errata/RHSA-2026:40118 cve-icon
https://access.redhat.com/errata/RHSA-2026:40945 cve-icon
https://access.redhat.com/errata/RHSA-2026:40984 cve-icon
https://access.redhat.com/errata/RHSA-2026:41941 cve-icon
https://access.redhat.com/errata/RHSA-2026:41944 cve-icon
https://access.redhat.com/errata/RHSA-2026:5168 cve-icon
https://access.redhat.com/errata/RHSA-2026:5807 cve-icon
https://access.redhat.com/errata/RHSA-2026:5907 cve-icon
https://access.redhat.com/errata/RHSA-2026:5910 cve-icon
https://access.redhat.com/errata/RHSA-2026:6192 cve-icon
https://access.redhat.com/errata/RHSA-2026:6277 cve-icon
https://access.redhat.com/errata/RHSA-2026:6309 cve-icon
https://access.redhat.com/errata/RHSA-2026:6497 cve-icon
https://access.redhat.com/errata/RHSA-2026:6567 cve-icon
https://access.redhat.com/errata/RHSA-2026:6568 cve-icon
https://access.redhat.com/errata/RHSA-2026:6802 cve-icon
https://access.redhat.com/errata/RHSA-2026:7314 cve-icon
https://access.redhat.com/errata/RHSA-2026:9742 cve-icon
https://access.redhat.com/security/cve/CVE-2025-69873 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2439070 cve-icon
https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md cve-icon cve-icon cve-icon
https://github.com/advisories/GHSA-2g4f-4pwh-qvx6 cve-icon cve-icon
https://github.com/ajv-validator/ajv/pull/2588 cve-icon cve-icon
https://github.com/ajv-validator/ajv/pull/2590 cve-icon cve-icon
https://github.com/ajv-validator/ajv/releases/tag/v6.14.0 cve-icon cve-icon
https://github.com/github/advisory-database/pull/6991 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-69873 cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-69873 cve-icon
History
Type Values Removed Values Added
Description ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.
References
Type Values Removed Values Added
Description ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.
References
Type Values Removed Values Added
First Time appeared Ajv.js
Ajv.js ajv
CPEs cpe:2.3:a:ajv.js:ajv:*:*:*:*:*:*:*:*
Vendors & Products Ajv.js
Ajv.js ajv
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 2.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}
Type Values Removed Values Added
First Time appeared Ajv-validator
Ajv-validator ajv
Vendors & Products Ajv-validator
Ajv-validator ajv
Type Values Removed Values Added
Title ajv: ReDoS via $data reference
Weaknesses CWE-1333
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Weaknesses CWE-400
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Sep 14, 2026, 12:04 PM
Reserved
Jan 9, 2026, 12:00 AM

View source JSON

Updated
Sep 14, 2026, 12:04 PM

JSON

Status
Deferred
Published
Feb 11, 2026, 7:15 PM
Modified
Sep 10, 2026, 1:17 PM

View source JSON

Severity
Important
Public date
Feb 11, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Feb 17, 2026, 8:50 AM

JSON