ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.
References
Configurations
No configuration.
History
21 Jul 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
17 Jul 2026, 13:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Jul 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Jul 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Jun 2026, 05:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Jun 2026, 03:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Mar 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | (en) ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0. |
23 Feb 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
|
| Summary | (en) ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. | |
| CWE | CWE-1333 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 2.9 |
| References |
|
12 Feb 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-400 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
11 Feb 2026, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-11 19:15
Updated : 2026-07-21 12:17
NVD link : CVE-2025-69873
Mitre link : CVE-2025-69873
CVE.ORG link : CVE-2025-69873
JSON object : View
Products Affected
No product.