CVE-2025-69873
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.
Scoring
- Severity
- LOW
- CVSS base score
- 2.9
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS probability
- 0.50%
- CWE
- CWE-1333
- Published
- 2026-02-11
- Last modified
- 2026-09-14
Affected products
- ajv.js ajv
- ajv.js ajv
- npm ajv
- npm ajv
Weakness type
Related vulnerabilities
- CVE-2026-25547 — @isaacs/brace-expansion has Uncontrolled Resource Consumption
- CVE-2025-25200 — Koa has Inefficient Regular Expression Complexity
- CVE-2026-26996 — minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
- CVE-2025-6998 — Calibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoS
- CVE-2025-58451 — Cattown Vulnerable to Inefficient Regular Expression Complexity and Uncontrolled Resource Consumption
- CVE-2026-30925 — Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
- CVE-2026-52778 — YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)
- CVE-2025-62484 — Zoom Workplace Clients - Inefficient Regular Expression Complexity