CVE-2025-69873

Name	CVE-2025-69873
Description	ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a\|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1128140

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-ajv (PTS)	bullseye	6.12.6-2	vulnerable
	bookworm	6.12.6-3	vulnerable
	trixie	8.12.0~ds+~2.1.1-5	vulnerable
	forky, sid	8.17.1~ds+~3.0.1+~3.1.0-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-ajv	source	(unstable)	(unfixed)			1128140

Notes

[trixie] - node-ajv <no-dsa> (Minor issue)
[bookworm] - node-ajv <no-dsa> (Minor issue)
[bullseye] - node-ajv <postponed> (Minor issue)
https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md
https://github.com/ajv-validator/ajv/issues/2581
Fixed by: https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5 (v8.18.0)