Junglewise Threat Intelligence

CVE-2025-69873: Ajv ReDoS in pattern keyword with $data option enabled

CVE-2025-69873 · Severity: medium · CVSS 4 · Published 2026-02-11

Executive brief

ajv is a widely-used JSON Schema validator that supports dynamic schema references through the $data option. When this feature is enabled, users can provide regular expression patterns as input data. An attacker can craft malicious regex patterns (such as those prone to catastrophic backtracking) that cause the application to consume excessive CPU resources, effectively denying service to legitimate users. This is particularly concerning for web services and APIs that use ajv with $data enabled for schema validation.

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in ajv's pattern keyword handling when the $data option is enabled. The root cause is that pattern values from validated data are passed to the native RegExp() constructor without safeguards against malicious regex syntax or catastrophic backtracking patterns. When $data: true, attackers can supply patterns like ^(a|a)*$ that exhibit exponential time complexity during matching. The attack requires network access to an endpoint that validates JSON against a schema using ajv with $data enabled, and the attacker must be able to control the pattern value in the input data. Patches were implemented across multiple versions (v8 main branch and v6 backport) to wrap pattern handling in try/catch blocks and utilize a configured RegExp engine with additional safeguards to mitigate ReDoS attacks.

Affected products

  • ajv-validator ajv versions prior to patches in v6 and v8

Timeline

  • 2026-02-11: disclosed: Vulnerability disclosed via GHSA-2g4f-4pwh-qvx6
  • 2026-02-14: patched: Fix merged for v8 in PR #2586 using configured RegExp engine
  • 2026-02-20: patched: Backport fix for v6 merged in PR #2590 with regExp option

References