{"id":"CVE-2025-69873","title":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled","summary":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which i…","severity":"low","cvss":2.9,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-1333","CWE-400"],"vendor":"ajv.js","product":"ajv","affected":["ajv < 6.14.0","ajv >= 7.0.0 < 8.17.2"],"published":"2026-02-11","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:17:29.420","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873","references":[{"url":"https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md","label":"cve@mitre.org"},{"url":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6","label":"cve@mitre.org"},{"url":"https://github.com/ajv-validator/ajv/pull/2588","label":"cve@mitre.org"},{"url":"https://github.com/ajv-validator/ajv/pull/2590","label":"cve@mitre.org"},{"url":"https://github.com/ajv-validator/ajv/releases/tag/v6.14.0","label":"cve@mitre.org"},{"url":"https://github.com/github/advisory-database/pull/6991","label":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2026:10093","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:13512","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:14774","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:15091","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:16874","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26211","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26214","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33371","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36651","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40118","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40945","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40984","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41941","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41944","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:5168","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:5807","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:5907","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:5910","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6192","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6277","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6309","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6497","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6567","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6568","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6802","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7314","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:9742","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2025-69873","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2439070","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-02-12T15:13:03.482882Z"},"epss":0.005,"epssPercentile":0.4174,"ingestedAt":"2026-07-01T03:50:34.375Z","slug":"CVE-2025-69873","body":"## Overview\n\najv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":28,"depthScoreParts":{"impact":16,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201423,"id":"CVE-2025-69873","ts":1789399448167,"field":"exploit_available","old":"false","new":"true"},{"seq":200158,"id":"CVE-2025-69873","ts":1789396901257,"field":"exploit_available","old":"true","new":"false"},{"seq":198078,"id":"CVE-2025-69873","ts":1789387948228,"field":"exploit_available","old":"false","new":"true"},{"seq":195875,"id":"CVE-2025-69873","ts":1789383284054,"field":"exploit_available","old":"true","new":"false"},{"seq":194803,"id":"CVE-2025-69873","ts":1789380270502,"field":"exploit_available","old":"false","new":"true"},{"seq":193591,"id":"CVE-2025-69873","ts":1789378143753,"field":"exploit_available","old":"true","new":"false"},{"seq":192377,"id":"CVE-2025-69873","ts":1789376189247,"field":"exploit_available","old":"false","new":"true"},{"seq":191165,"id":"CVE-2025-69873","ts":1789373016546,"field":"exploit_available","old":"true","new":"false"},{"seq":189949,"id":"CVE-2025-69873","ts":1789369091423,"field":"exploit_available","old":"false","new":"true"},{"seq":188737,"id":"CVE-2025-69873","ts":1789367969560,"field":"exploit_available","old":"true","new":"false"},{"seq":187519,"id":"CVE-2025-69873","ts":1789364939924,"field":"exploit_available","old":"false","new":"true"},{"seq":186307,"id":"CVE-2025-69873","ts":1789362894289,"field":"exploit_available","old":"true","new":"false"},{"seq":185093,"id":"CVE-2025-69873","ts":1789360927263,"field":"exploit_available","old":"false","new":"true"},{"seq":183880,"id":"CVE-2025-69873","ts":1789357829985,"field":"exploit_available","old":"true","new":"false"},{"seq":182132,"id":"CVE-2025-69873","ts":1789354052815,"field":"exploit_available","old":"false","new":"true"},{"seq":180925,"id":"CVE-2025-69873","ts":1789352857967,"field":"exploit_available","old":"true","new":"false"},{"seq":179718,"id":"CVE-2025-69873","ts":1789349949924,"field":"exploit_available","old":"false","new":"true"},{"seq":178511,"id":"CVE-2025-69873","ts":1789347693330,"field":"exploit_available","old":"true","new":"false"},{"seq":177304,"id":"CVE-2025-69873","ts":1789346132573,"field":"exploit_available","old":"false","new":"true"},{"seq":176097,"id":"CVE-2025-69873","ts":1789342636172,"field":"exploit_available","old":"true","new":"false"},{"seq":175883,"id":"CVE-2025-69873","ts":1789342238392,"field":"exploit_available","old":"false","new":"true"},{"seq":175421,"id":"CVE-2025-69873","ts":1789338263366,"field":"exploit_available","old":"true","new":"false"},{"seq":174216,"id":"CVE-2025-69873","ts":1789334559701,"field":"exploit_available","old":"false","new":"true"},{"seq":173011,"id":"CVE-2025-69873","ts":1789333121453,"field":"exploit_available","old":"true","new":"false"},{"seq":171825,"id":"CVE-2025-69873","ts":1789330836066,"field":"exploit_available","old":"false","new":"true"},{"seq":170639,"id":"CVE-2025-69873","ts":1789328273450,"field":"exploit_available","old":"true","new":"false"},{"seq":169434,"id":"CVE-2025-69873","ts":1789326852705,"field":"exploit_available","old":"false","new":"true"},{"seq":168229,"id":"CVE-2025-69873","ts":1789323297265,"field":"exploit_available","old":"true","new":"false"},{"seq":167024,"id":"CVE-2025-69873","ts":1789319313340,"field":"exploit_available","old":"false","new":"true"},{"seq":165819,"id":"CVE-2025-69873","ts":1789318148548,"field":"exploit_available","old":"true","new":"false"},{"seq":164614,"id":"CVE-2025-69873","ts":1789315500824,"field":"exploit_available","old":"false","new":"true"},{"seq":163409,"id":"CVE-2025-69873","ts":1789313167385,"field":"exploit_available","old":"true","new":"false"},{"seq":162204,"id":"CVE-2025-69873","ts":1789311681467,"field":"exploit_available","old":"false","new":"true"},{"seq":160999,"id":"CVE-2025-69873","ts":1789308161494,"field":"exploit_available","old":"true","new":"false"},{"seq":160504,"id":"CVE-2025-69873","ts":1789304104150,"field":"exploit_available","old":"false","new":"true"},{"seq":158342,"id":"CVE-2025-69873","ts":1789299169488,"field":"exploit_available","old":"true","new":"false"},{"seq":157306,"id":"CVE-2025-69873","ts":1789296426640,"field":"exploit_available","old":"false","new":"true"},{"seq":156101,"id":"CVE-2025-69873","ts":1789294282038,"field":"exploit_available","old":"true","new":"false"},{"seq":154896,"id":"CVE-2025-69873","ts":1789292594320,"field":"exploit_available","old":"false","new":"true"},{"seq":153691,"id":"CVE-2025-69873","ts":1789289235039,"field":"exploit_available","old":"true","new":"false"},{"seq":152903,"id":"CVE-2025-69873","ts":1789285123064,"field":"exploit_available","old":"false","new":"true"},{"seq":152147,"id":"CVE-2025-69873","ts":1789280861608,"field":"exploit_available","old":"true","new":"false"},{"seq":151108,"id":"CVE-2025-69873","ts":1789277379344,"field":"exploit_available","old":"false","new":"true"},{"seq":150075,"id":"CVE-2025-69873","ts":1789275825423,"field":"exploit_available","old":"true","new":"false"},{"seq":149042,"id":"CVE-2025-69873","ts":1789273578267,"field":"exploit_available","old":"false","new":"true"},{"seq":147837,"id":"CVE-2025-69873","ts":1789270775985,"field":"exploit_available","old":"true","new":"false"},{"seq":145877,"id":"CVE-2025-69873","ts":1789269143297,"field":"exploit_available","old":"false","new":"true"},{"seq":144781,"id":"CVE-2025-69873","ts":1789266039436,"field":"exploit_available","old":"true","new":"false"},{"seq":143685,"id":"CVE-2025-69873","ts":1789262410488,"field":"exploit_available","old":"false","new":"true"},{"seq":142521,"id":"CVE-2025-69873","ts":1789261105724,"field":"exploit_available","old":"true","new":"false"}]}