CVE catalog

CVE-2025-69873

node-ajv: CVE-2025-69873

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.55% · Oct 25, 2026

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-ajvsid8.20.0~ds+~cs7.2.4-1fixed
Debiannode-ajvforky8.20.0~ds+~cs7.2.4-1fixed
Debiannode-ajvtrixie8.12.0~ds+~2.1.1-5vulnerable
Debiannode-ajvbookworm6.12.6-3vulnerable
NpmajvNot reported6.14.0fixed
NpmajvNot reported6.14.0fixed
Ubuntunode-ajv18.045.0.0-1vulnerable
Ubuntunode-ajv20.046.10.2-1vulnerable
Ubuntunode-ajv22.046.12.6-2vulnerable
Ubuntunode-ajv22.046.12.6-3vulnerable
Ubuntunode-ajv24.046.12.6-3vulnerable
Ubuntunode-ajv24.048.12.0~ds+~2.1.1-4vulnerable
Ubuntunode-ajv25.108.12.0~ds+~2.1.1-5vulnerable
Ubuntunode-ajv26.108.17.1~ds+~3.0.1+~3.1.0-4build1vulnerable
Ubuntunode-ajv26.108.20.0~ds+~cs6.1.3-1vulnerable
Ubuntunode-ajv26.108.20.0~ds+~cs7.1.2-1vulnerable
Ubuntunode-ajv26.108.20.0~ds+~cs7.1.3-1vulnerable
Ubuntunode-ajv26.108.20.0~ds+~cs7.1.3-3vulnerable
Ubuntunode-ajv26.048.12.0~ds+~2.1.1-5vulnerable
Ubuntunode-ajv26.048.17.1~ds+~3.0.1+~3.1.0-2vulnerable
Ubuntunode-ajv26.048.17.1~ds+~3.0.1+~3.1.0-4build1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-ajvsourcesid8.18.0~ds+~cs6.1.1-1not yet assignedNot reported[1128140]
Debiannode-ajvsourceforky8.18.0~ds+~cs6.1.1-1not yet assignedNot reported[1128140]
Debiannode-ajvsourcetrixie(unfixed)not yet assignedNot reported[1128140]
Debiannode-ajvsourcebookworm(unfixed)not yet assignedNot reported[1128140]
NpmajvnpmNot reported6.14.0Not reportedGHSA-2G4F-4PWH-QVX6Not reported
NpmajvnpmNot reported6.14.0Not reportedNot reportedNot reported

[Debian bug #1128140]

Notes

[trixie] node-ajv: Minor issue [bookworm] node-ajv: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-ajv]Affected
    Details (2)

    • 6.12.6-3 · all · bookworm

      Affected

      dsa · node-ajv · debian · bookworm; dsa · node-ajv · debian · 12

    • 6.12.6-3 · all · bookworm

      Affected

      dsa · node-ajv · debian · bookworm; dsa · node-ajv · debian · 12

[Debian 13 (Trixie)]

  • [node-ajv]Affected
    Details (2)

    • 8.12.0~ds+~2.1.1-5 · all · trixie

      Affected

      dsa · node-ajv · debian · 13

    • 8.12.0~ds+~2.1.1-5 · all · trixie

      Affected

      dsa · node-ajv · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]