ajv has ReDoS when using `$data` option
ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | ajv | >= 7.0.0-alpha.0, < 8.18.0, < 6.14.0 | 8.18.0, 6.14.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-69873
- https://github.com/ajv-validator/ajv/pull/2586
- https://github.com/ajv-validator/ajv/pull/2588
- https://github.com/ajv-validator/ajv/pull/2590
- https://github.com/github/advisory-database/pull/6991
- https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5
- https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md
- https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
- https://github.com/ajv-validator/ajv
- https://github.com/ajv-validator/ajv/releases/tag/v6.14.0
- https://github.com/ajv-validator/ajv/releases/tag/v8.18.0
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P- Weakness (CWE)
CWE-1333, CWE-400- Platform
- npm
- Package
ajv- Disclosed
- 11.02.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-2g4f-4pwh-qvx6 - CC BY 4.0
Vulnerability history: ajv
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 02.2022 02.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 2
Disclosures per year
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 1
-
ajv has ReDoS when using `$data` option this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.