CVE-2025-69873 ajv has ReDoS when using `$data` option
Attackers can cause denial of service via catastrophic backtracking in ajv when the $data option is enabled, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-69873?
CVE-2025-69873 is a low-severity denial of service vulnerability in ajv.js ajv, published on 11 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.
Which versions are affected by CVE-2025-69873?
4 open source packages ship an affected version, including ajv.
| Package | Affected | Fixed in |
|---|---|---|
ajv npm | All versions | 6.14.0 |
ajv npm | All versions | 6.14.0 |
ajv npm | From 7.0.0-alpha.0 | 8.18.0 |
ajv npm | From 7.0.0-alpha.0 | 8.18.0 |
How do I fix CVE-2025-69873?
Upgrade ajv to a fixed version for your release line: 6.14.0 or 8.18.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-69873 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-69873 exists.
Sources
Also known as CLEANSTART-2026-LI51874, CLEANSTART-2026-NS67921, CLEANSTART-2026-VM51396, CLSA-2026-1773015259, CLSA-2026-1773015260, CLSA-2026-1773015261 and 45 more.