NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
LOW severity

CVE-2025-69873 — ajv

LOWFix: ajv-validator/ajv#2588

CVE-2025-69873 is a low-severity (CVSS 2.9) CWE-1333 vulnerability in ajv. A fix is available for ajv — see the affected versions and patch details below.

ajv has ReDoS when using `$data` option

Also known asGHSA-2g4f-4pwh-qvx6
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Oct 24, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-69873.

EPSS Exploitation Probability

via FIRST.org ↗
0.5%probability of exploitation in next 30 days
Lower Risk+0.03%
Lower risk than most CVEs45th percentile — riskier than 45% of all scored CVEsHighest risk
0.00%0.35%0.70%1.05%0.0%0.5%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

21Kother npm packages depend on this — each one inherits the vulnerability until it's patched upstream
ajvnpm
249.3Mdownloads / week

Description

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
📦npmajv≥ 7.0.0-alpha.0&&< 8.18.08.18.0npm install ajv@8.18.0
📦npmajvall versions6.14.0npm install ajv@6.14.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ajv, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update ajv to 8.18.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-69873 is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

To exploit this issue, the $data option must be enabled and the attacker needs to be able to send a payload with a specially crafted regular expression to the application processing the input. A 31-character payload causes approximately 44 seconds of execution, with each additional character doubling the execution…

Workaround published by Red Hat
To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters.
Source: Red Hat security advisory for CVE-2025-69873 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Ansible Automation Platform 2.5 for RHEL 8automation-gateway-0:2.5.20260422-2.el8apRHSA-2026:13512
Red Hat Ansible Automation Platform 2.6 for RHEL 9automation-platform-ui-0:2.6.7-1.el9apRHSA-2026:6277
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7eap7-wildfly-0:7.3.18-3.GA_redhat_00001.1.el7eapRHSA-2026:33371
Network Observability (NETOBSERV) 1.11.0network-observability/network-observability-console-plugin-compat-rhel9:1778508956RHSA-2026:16874
Red Hat Ansible Automation Platform 2.6ansible-automation-platform-26/gateway-rhel9:1774243862RHSA-2026:6309
Red Hat Ansible Automation Platform 2.6ansible-automation-platform-26/gateway-rhel9:1774243862RHSA-2026:6404
Red Hat Ceph Storage 9.2rhceph/rhceph-9-rhel10:1790843527RHSA-2026:86618
Red Hat Developer Hub 1.8rhdh/rhdh-hub-rhel9:1776784286RHSA-2026:9742

Frequently Asked Questions

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete deni
O3 Security · Impact-Aware SCA

Is CVE-2025-69873 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2025-69873: ajv DoS — Fixed in 8.18.0