{"schema_version":"1.9.0","id":"CVE-2025-69873","published":"2026-02-11T00:00:00Z","modified":"2026-09-09T03:30:38.032059681Z","aliases":["GHSA-2g4f-4pwh-qvx6"],"details":"ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ajv-validator/ajv","events":[{"introduced":"0"},{"fixed":"e3af0a723b4b7ad86eff43be355c706d31e0e915"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.14.0"}],"source":"AFFECTED_FIELD"}}],"versions":["v6.12.6","v6.12.5","v6.12.4","v6.12.3","v6.12.2","v6.12.1","v6.12.0","v6.11.0","v6.10.2","v6.10.1","v6.10.0","v6.9.2","v6.9.1","v6.9.0","v6.8.1","v6.8.0","v6.7.0","v6.6.2","v6.6.1","v6.6.0","v6.5.5","v6.5.4","v6.5.3","v6.5.2","v6.5.1","v6.5.0","v6.4.0","v6.3.0","v6.2.1","v6.2.0","v6.1.1","v6.1.0","v6.0.1","v6.0.0","v5.5.2","v5.5.1","v5.5.0","v5.4.0","v5.3.0","v5.2.5","v5.2.4","v5.2.3","v5.2.2","v5.2.1","v5.2.0","v5.1.6","v5.1.5","v5.1.4","v5.1.3","v5.1.2","v5.1.1","v5.1.0","5.0.1","4.11.7","5.0.0","4.11.6","4.11.0","4.10.0","4.9.0","4.8.0","4.7.0","4.6.0","4.5.0","4.4.0","4.3.0","4.2.0","4.1.0","4.0.0","3.8.0","3.7.2","3.7.0","3.6.0","3.5.0","3.4.0","3.3.0","3.2.2","3.2.1","3.2.0","3.1.0","3.0.0","2.5.0","2.4.0","2.3.0","2.2.0","2.1.0","2.0.0","1.4.10","1.4.9","1.4.8","1.4.7","1.4.6","1.4.5","1.4.4","1.4.3","1.4.2","1.4.1","1.4.0","1.3.2","1.3.1","1.2.1","1.2.0","1.1.1","1.1.0","1.0.1","1.0.0","0.7.0","0.6.11","0.6.10","0.6.9","0.6.1","0.6.0","0.5.11","0.5.9","0.5.6","0.5.2","0.5.1","0.5.0","0.4.14","0.4.4","0.4.1","0.4.0","0.3.8","0.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-69873.json"}}],"references":[{"type":"WEB","url":"https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md"},{"type":"WEB","url":"https://github.com/ajv-validator/ajv/releases/tag/v6.14.0"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69873.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10093"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13512"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14774"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:15091"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16874"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26211"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26214"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33371"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36651"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40118"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40945"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40984"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41941"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41944"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5168"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5807"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5907"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5910"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6192"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6277"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6309"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6497"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6567"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6568"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6802"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7314"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9742"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2025-69873"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69873.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2439070"},{"type":"FIX","url":"https://github.com/ajv-validator/ajv/pull/2588"},{"type":"FIX","url":"https://github.com/ajv-validator/ajv/pull/2590"},{"type":"FIX","url":"https://github.com/github/advisory-database/pull/6991"}],"database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-1333"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69873.json","unresolved_ranges":[{"extracted_events":[{"introduced":"7.0.0"},{"fixed":"8.17.2"}],"source":"AFFECTED_FIELD"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}