Log in Start free

Vulnerability · Published Feb 11, 2026 · Assigned by mitre

CVE-2025-69873

Low 2.9

In plain English

A low-severity regular-expression denial of service in ajv from ajv.js. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.9Low
Exploit odds (30 days)0.5%top 54.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-ajvno fix listedDEBIAN-CVE-2025-69873
Debian:13node-ajvno fix listedDEBIAN-CVE-2025-69873
Debian:14node-ajv8.18.0~ds+~cs6.1.1-1DEBIAN-CVE-2025-69873
Ubuntu:22.04:LTSnode-ajvno fix listedUBUNTU-CVE-2025-69873
Ubuntu:24.04:LTSnode-ajvno fix listedUBUNTU-CVE-2025-69873
Ubuntu:25.10node-ajvno fix listedUBUNTU-CVE-2025-69873
Ubuntu:26.04:LTSnode-ajvno fix listedUBUNTU-CVE-2025-69873
Ubuntu:26.10node-ajvno fix listedUBUNTU-CVE-2025-69873
npmajv6.14.0GHSA-2g4f-4pwh-qvx6
npmajv8.18.0GHSA-2g4f-4pwh-qvx6

Affected products (as reported)

VendorProductVersions
ajv.js ajv 0 – before 6.14.07.0.0 – before 8.17.2

Weakness: CWE-1333, CWE-400 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References