CVE-2025-69873: ajv Package Suffers from ReDoS Vulnerability with $data Option
Summary
CVE-2025-69873: ajv has ReDoS when using $data option. Affects ajv versions < 8.18.0. Fixed in 8.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ajv (Another JSON Schema Validator) is a widely used library for validating JSON objects against JSON Schema specifications. It provides features such as asynchronous validation, support for custom keywords, and the ability to use the $data option for dynamic schema validation. However, this flexibility comes with a risk, as the library is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.
Vulnerability Detail
The vulnerability arises from the way ajv handles regular expressions when the $data option is enabled. The pattern keyword allows runtime data to be passed directly to the JavaScript RegExp() constructor without proper validation. This can lead to catastrophic backtracking if an attacker injects a malicious regex pattern, such as '^(a|a)*$', combined with specially crafted input. A payload of just 31 characters can block CPU execution for approximately 44 seconds, and each additional character doubles the execution time, potentially leading to a complete denial of service with a single HTTP request.
How To Fix
Latest published version: 8.20.0 as of 22 Oct 2026
npm install ajv@8.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.18.0
This is the first release that contains the fix.
npm install ajv@8.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider disabling the $data option in your schema validation to mitigate the risk of this vulnerability. This can be done by ensuring that your schema does not utilize the $data reference.
Conclusion
The ajv package is vulnerable to a ReDoS attack when the $data option is enabled, allowing attackers to exploit this vulnerability to cause denial of service. It is crucial to update to version 8.18.0 or later to mitigate this risk. Additionally, disabling the $data option can serve as a temporary workaround while you plan for an update.
See every vulnerability recorded for ajv →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
The $data option allows the use of runtime data in JSON Schema validation, enabling dynamic schema validation based on the input data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
An attacker can exploit this vulnerability to cause denial of service, leading to significant downtime and performance issues for applications using ajv with the $data option enabled.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing your package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for ajv.
