CVE-2025-69873: Ajv.js Ajv

Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days.

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

Affected products

  • Ajv.js Ajv: before 6.14.0 (fixed in 6.14.0); from 7.0.0, before 8.17.2 (fixed in 8.17.2)
  • Red Hat Confidential Compute Attestation
  • Red Hat Cryostat 4
  • Red Hat Gatekeeper 3
  • Red Hat Logging Subsystem For Red Hat Openshift
  • Red Hat Multicluster Engine For Kubernetes
  • Red Hat Network Observability Netobserv 1.11.0: before 1778508956 (fixed in 1778508956)
  • Red Hat Network Observability Operator
  • Red Hat Node Healthcheck Operator
  • Red Hat Openshift Pipelines
  • Red Hat Openshift Service Mesh 2
  • Red Hat Openshift Service Mesh 3
  • Red Hat Red Hat 3scale API Management Platform 2
  • Red Hat Red Hat Advanced Cluster Management For Kubernetes 2
  • Red Hat Red Hat Advanced Cluster Security 4
  • Red Hat Red Hat Amq Broker 7
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform 2.5 For Rhel 8: before 0:2.5.20260422-2.el8ap (fixed in 0:2.5.20260422-2.el8ap)
  • Red Hat Red Hat Ansible Automation Platform 2.5 For Rhel 9: before 0:2.5.20260422-2.el9ap (fixed in 0:2.5.20260422-2.el9ap)
  • Red Hat Red Hat Ansible Automation Platform 2.6: before 1774243862 (fixed in 1774243862)
  • Red Hat Red Hat Ansible Automation Platform 2.6 For Rhel 9: before 0:2.6.7-1.el9ap (fixed in 0:2.6.7-1.el9ap)
  • Red Hat Red Hat Build Of Apache Camel - Hawtio 4
  • Red Hat Red Hat Build Of Apache Camel For Spring Boot 4
  • Red Hat Red Hat Build Of Apicurio Registry 2
  • Red Hat Red Hat Build Of Apicurio Registry 3
  • and 45 more

Published 2026-02-11. Last modified 2026-09-10.