NodeJS/ajv/8.11.1
Another JSON Schema Validator
https://www.npmjs.com/package/ajv
MIT
1 Security Vulnerabilities
ajv has ReDoS when using `$data` option
Published date: 2026-02-11T21:30:39Z
CVE: CVE-2025-69873
Links:
- https://nvd.nist.gov/vuln/detail/CVE-2025-69873
- https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md
- https://github.com/ajv-validator/ajv/pull/2586
- https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5
- https://github.com/ajv-validator/ajv/releases/tag/v8.18.0
- https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
- https://github.com/ajv-validator/ajv/pull/2588
- https://github.com/ajv-validator/ajv/releases/tag/v6.14.0
ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.
Affected versions: ["6.12.6", "6.12.5", "6.12.4", "6.12.3", "6.12.2", "6.12.1", "6.12.0", "6.11.0", "6.10.2", "6.10.1", "6.10.0", "6.9.2", "6.9.1", "6.9.0", "6.8.1", "6.8.0", "6.7.0", "6.6.2", "6.6.1", "6.6.0", "6.5.5", "6.5.4", "6.5.3", "6.5.2", "6.5.1", "6.5.0", "6.4.0", "6.3.0", "6.2.1", "6.2.0", "6.1.1", "6.1.0", "6.0.1", "6.0.0", "6.0.0-rc.1", "6.0.0-rc.0", "6.0.0-beta.2", "6.0.0-beta.1", "6.0.0-beta.0", "5.5.2", "5.5.1", "5.5.0", "5.4.0", "5.3.0", "5.2.5", "5.2.4", "5.2.3", "5.2.2", "5.2.1", "5.2.0", "5.1.6", "5.1.5", "5.1.4", "5.1.3", "5.1.2", "5.1.1", "5.1.0", "5.0.4-beta.3", "5.0.4-beta.2", "5.0.4-beta.1", "5.0.4-beta.0", "5.0.3-beta.0", "5.0.2-beta.0", "5.0.1", "5.0.1-beta.3", "5.0.1-beta.2", "5.0.1-beta.1", "5.0.1-beta.0", "5.0.0", "5.0.0-beta.1", "5.0.0-beta.0", "4.11.8", "4.11.7", "4.11.6", "4.11.5", "4.11.4", "4.11.3", "4.11.2", "4.11.1", "4.11.0", "4.10.4", "4.10.3", "4.10.2", "4.10.1", "4.10.0", "4.9.3", "4.9.2", "4.9.1", "4.9.0", "4.8.2", "4.8.1", "4.8.0", "4.7.7", "4.7.6", "4.7.5", "4.7.4", "4.7.3", "4.7.2", "4.7.1", "4.7.0", "4.6.1", "4.6.0", "4.5.0", "4.4.1", "4.4.0", "4.3.1", "4.3.0", "4.2.0", "4.1.8", "4.1.7", "4.1.6", "4.1.5", "4.1.4", "4.1.3", "4.1.2", "4.1.1", "4.1.0", "4.0.6", "4.0.5", "4.0.4", "4.0.3", "4.0.2", "4.0.1", "4.0.0", "3.8.10", "3.8.9", "3.8.8", "3.8.7", "3.8.6", "3.8.5", "3.8.4", "3.8.3", "3.8.2", "3.8.1", "3.8.0", "3.7.2", "3.7.1", "3.7.0", "3.6.2", "3.6.1", "3.6.0", "3.5.3", "3.5.2", "3.5.1", "3.5.0", "3.4.0", "3.3.1", "3.3.0", "3.2.3", "3.2.2", "3.2.1", "3.2.0", "3.1.1", "3.1.0", "3.0.4", "3.0.3", "3.0.2", "3.0.1", "3.0.0", "2.5.0", "2.4.0", "2.3.0", "2.2.2", "2.2.1", "2.2.0", "2.1.4", "2.1.3", "2.1.2", "2.1.0", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0", "2.0.0-beta.3", "2.0.0-beta.2", "2.0.0-beta.1", "2.0.0-beta.0", "1.4.10", "1.4.9", "1.4.8", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.3.2", "1.3.1", "1.3.0", "1.2.1", "1.2.0", "1.1.1", "1.0.1", "1.0.0", "0.7.2", "0.7.1", "0.7.0", "0.6.15", "0.6.14", "0.6.13", "0.6.12", "0.6.11", "0.6.10", "0.6.9", "0.6.8", "0.6.7", "0.6.6", "0.6.5", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.5.12", "0.5.11", "0.5.10", "0.5.9", "0.5.8", "0.5.7", "0.5.6", "0.5.5", "0.5.4", "0.5.3", "0.5.2", "0.5.0", "0.4.15", "0.4.14", "0.4.12", "0.4.10", "0.4.9", "0.4.8", "0.4.7", "0.4.6", "0.4.5", "0.4.4", "0.4.3", "0.4.2", "0.4.1", "0.4.0", "0.3.12", "0.3.11", "0.3.8", "0.3.7", "0.3.6", "0.3.5", "0.3.4", "0.3.3", "0.3.2", "0.3.1", "0.3.0", "0.2.9", "0.2.8", "0.2.7", "0.2.6", "0.2.5", "0.2.4", "0.2.3", "0.2.2", "0.2.1", "0.2.0", "0.1.16", "0.1.15", "0.1.14", "0.1.13", "0.1.12", "0.1.11", "0.1.10", "0.1.9", "0.1.8", "0.1.7", "0.1.6", "0.1.5", "0.1.4", "0.1.3", "0.1.2", "0.1.1", "0.1.0", "0.0.12", "0.0.11", "0.0.10", "0.0.9", "0.0.8", "0.0.7", "0.0.6", "0.0.5", "0.0.4", "8.17.1", "8.16.0", "8.15.0", "8.14.0", "8.13.0", "8.12.0", "8.11.2", "8.11.1", "8.11.0", "8.10.0", "8.9.0", "8.8.2", "8.8.1", "8.8.0", "8.7.1", "8.7.0", "8.6.3", "8.6.2", "8.6.1", "8.6.0", "8.5.0", "8.4.0", "8.3.0", "8.2.0", "8.1.0", "8.0.5", "8.0.4", "8.0.3", "8.0.2", "8.0.1", "8.0.0", "8.0.0-beta.4", "8.0.0-beta.3", "8.0.0-beta.2", "8.0.0-beta.1", "8.0.0-beta.0", "7.2.4", "7.2.3", "7.2.2", "7.2.1", "7.2.0", "7.1.1", "7.1.0", "7.0.4", "7.0.3", "7.0.2", "7.0.1", "7.0.0", "7.0.0-rc.5", "7.0.0-rc.4", "7.0.0-rc.3", "7.0.0-rc.2", "7.0.0-rc.1", "7.0.0-rc.0", "7.0.0-beta.9", "7.0.0-beta.8", "7.0.0-beta.7", "7.0.0-beta.6", "7.0.0-beta.5", "7.0.0-beta.4", "7.0.0-beta.3", "7.0.0-beta.2", "7.0.0-beta.1", "7.0.0-beta.0", "7.0.0-alpha.1", "7.0.0-alpha.0"]
Secure versions: [6.14.0, 8.18.0]
Recommendation: Update to version 8.18.0.
357 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 6.0.1 | MIT | 2 | 2018-01-11 - 22:04 | about 8 years |
| 6.0.0 | MIT | 2 | 2018-01-07 - 15:32 | about 8 years |
| 6.0.0-rc.1 | MIT | 2 | 2017-12-03 - 17:59 | about 8 years |
| 6.0.0-rc.0 | MIT | 2 | 2017-11-26 - 10:49 | over 8 years |
| 6.0.0-beta.2 | MIT | 2 | 2017-11-12 - 10:13 | over 8 years |
| 6.0.0-beta.1 | MIT | 2 | 2017-11-06 - 10:18 | over 8 years |
| 6.0.0-beta.0 | MIT | 2 | 2017-11-06 - 07:43 | over 8 years |
| 5.5.2 | MIT | 2 | 2017-12-16 - 20:35 | about 8 years |
| 5.5.1 | MIT | 2 | 2017-12-02 - 12:48 | about 8 years |
| 5.5.0 | MIT | 2 | 2017-11-24 - 20:45 | over 8 years |
| 5.4.0 | MIT | 2 | 2017-11-20 - 21:23 | over 8 years |
| 5.3.0 | MIT | 2 | 2017-10-24 - 19:00 | over 8 years |
| 5.2.5 | MIT | 2 | 2017-10-24 - 10:32 | over 8 years |
| 5.2.4 | MIT | 2 | 2017-10-22 - 15:16 | over 8 years |
| 5.2.3 | MIT | 2 | 2017-09-25 - 20:57 | over 8 years |
| 5.2.2 | MIT | 2 | 2017-07-10 - 22:19 | over 8 years |
| 5.2.1 | MIT | 2 | 2017-07-06 - 23:29 | over 8 years |
| 5.2.0 | MIT | 2 | 2017-06-16 - 23:13 | over 8 years |
| 5.1.6 | MIT | 2 | 2017-06-15 - 22:37 | over 8 years |
| 5.1.5 | MIT | 2 | 2017-05-28 - 19:59 | almost 9 years |
| 5.1.4 | MIT | 2 | 2017-05-25 - 21:17 | almost 9 years |
| 5.1.3 | MIT | 2 | 2017-05-20 - 21:35 | almost 9 years |
| 5.1.2 | MIT | 2 | 2017-05-19 - 19:53 | almost 9 years |
| 5.1.1 | MIT | 2 | 2017-05-14 - 22:50 | almost 9 years |
| 5.1.0 | MIT | 2 | 2017-05-14 - 11:17 | almost 9 years |
| 5.0.4-beta.3 | MIT | 2 | 2017-04-08 - 20:11 | almost 9 years |
| 5.0.4-beta.2 | MIT | 2 | 2017-03-25 - 16:33 | almost 9 years |
| 5.0.4-beta.1 | MIT | 2 | 2017-03-19 - 19:57 | almost 9 years |
| 5.0.4-beta.0 | MIT | 2 | 2017-03-12 - 18:46 | almost 9 years |
| 5.0.3-beta.0 | MIT | 2 | 2017-03-01 - 08:16 | almost 9 years |
| 5.0.2-beta.0 | MIT | 2 | 2017-02-12 - 19:39 | about 9 years |
| 5.0.1 | MIT | 2 | 2017-04-28 - 20:22 | almost 9 years |
| 5.0.1-beta.3 | MIT | 2 | 2017-02-04 - 23:03 | about 9 years |
| 5.0.1-beta.2 | MIT | 2 | 2017-01-23 - 21:04 | about 9 years |
| 5.0.1-beta.1 | MIT | 2 | 2017-01-20 - 23:50 | about 9 years |
| 5.0.1-beta.0 | MIT | 2 | 2016-12-31 - 00:39 | about 9 years |
| 5.0.0 | MIT | 2 | 2017-04-17 - 14:42 | almost 9 years |
| 5.0.0-beta.1 | MIT | 2 | 2016-11-30 - 21:21 | about 9 years |
| 5.0.0-beta.0 | MIT | 2 | 2016-11-08 - 19:29 | over 9 years |
| 4.11.8 | MIT | 2 | 2017-04-28 - 19:23 | almost 9 years |
| 4.11.7 | MIT | 2 | 2017-04-17 - 13:30 | almost 9 years |
| 4.11.6 | MIT | 2 | 2017-04-07 - 22:56 | almost 9 years |
| 4.11.5 | MIT | 2 | 2017-03-11 - 21:44 | almost 9 years |
| 4.11.4 | MIT | 2 | 2017-03-04 - 18:34 | almost 9 years |
| 4.11.3 | MIT | 2 | 2017-02-12 - 19:18 | about 9 years |
| 4.11.2 | MIT | 2 | 2017-01-21 - 21:45 | about 9 years |
| 4.11.1 | MIT | 2 | 2017-01-21 - 00:32 | about 9 years |
| 4.11.0 | MIT | 2 | 2017-01-21 - 00:17 | about 9 years |
| 4.10.4 | MIT | 2 | 2017-01-05 - 20:03 | about 9 years |
| 4.10.3 | MIT | 2 | 2016-12-25 - 00:17 | about 9 years |