{"id":"CVE-2025-69873","aliases":["GHSA-2g4f-4pwh-qvx6"],"url":"https://o3.security/vulnerability/CVE-2025-69873","summary":"ajv has ReDoS when using `$data` option","details":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.","published":"2026-02-11T00:00:00Z","modified":"2026-09-15T03:30:53.179660060Z","cvss":{"score":2.9,"severity":"LOW","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"ajv","fixedVersion":"8.18.0"},{"ecosystem":"npm","name":"ajv","fixedVersion":"6.14.0"}],"fix":{"url":"https://github.com/ajv-validator/ajv/pull/2588","label":"ajv-validator/ajv#2588"},"references":[{"type":"WEB","url":"https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md"},{"type":"WEB","url":"https://github.com/ajv-validator/ajv/releases/tag/v6.14.0"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10093"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13512"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14774"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:15091"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16874"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26211"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26214"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33371"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36651"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40118"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40945"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40984"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41941"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41944"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5168"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5807"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5907"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5910"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6192"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6277"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6309"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6497"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6567"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6568"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6802"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7314"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9742"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2025-69873"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69873.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2439070"},{"type":"FIX","url":"https://github.com/ajv-validator/ajv/pull/2588"},{"type":"FIX","url":"https://github.com/ajv-validator/ajv/pull/2590"},{"type":"FIX","url":"https://github.com/github/advisory-database/pull/6991"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-15T03:30:53.179660060Z"}}