CVE-2025-69873 Details

A Regular Expression Denial-of-Service (ReDoS) vulnerability has been identified in ajv (Another JSON Schema Validator) versions through 8.17.1. This issue arises when the $data option is enabled, allowing the pattern keyword to accept runtime data via JSON Pointer syntax. The injected regex patterns are passed directly to the JavaScript RegExp constructor without any validation, enabling attackers to exploit catastrophic backtracking. A payload of 31 characters can block the CPU for approximately 44 seconds, causing a complete denial of service with a single HTTP request to any API using ajv with $data: true for dynamic schema validation.

Users can mitigate this vulnerability by avoiding the use of $data with the pattern keyword, pre-validating dynamic regex patterns with the safe-regex package, or by using Google's RE2 regex engine, which is supported by ajv and eliminates backtracking.