Regular expression denial of service in ajv.js ajv
Priority HIGH 72CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 29 fixed, 17 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00539 45th percentileScored 2026-11-07
Fix Partial ajv (ajv.js): 6.14.0, 8.17.2ajv (npm): 8.18.0, 6.14.0Red Hat: 32 advisoriesRed Hat: 29 fixed, 17 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ajv.js | ajv | before 6.14.0; 7.0.0 to before 8.17.2 | 6.14.0, 8.17.2 | Patch available | CNA |
| — | ajv (npm) | 7.0.0-alpha.0 to before 8.18.0 | 8.18.0 | Patch available | GHSA-2g4f-4pwh-qvx6 |
| — | ajv (npm) | before 6.14.0 | 6.14.0 | Patch available | GHSA-2g4f-4pwh-qvx6 |
- ajv Vendorajv.js Affected before 6.14.0; 7.0.0 to before 8.17.2 Fixed in 6.14.0, 8.17.2 Patch available CNA
- ajv (npm) Vendor— Affected 7.0.0-alpha.0 to before 8.18.0 Fixed in 8.18.0 Patch available GHSA-2g4f-4pwh-qvx6
- ajv (npm) Vendor— Affected before 6.14.0 Fixed in 6.14.0 Patch available GHSA-2g4f-4pwh-qvx6
Remediation
- Fix · CNA ajv (ajv.js) Fixed in 6.14.0, 8.17.2
- Fix · GHSA-2g4f-4pwh-qvx6 ajv (npm) Fixed in 8.18.0 Advisory →
- Fix · GHSA-2g4f-4pwh-qvx6 ajv (npm) Fixed in 6.14.0 Advisory →
Red Hat 32 advisories
- RHSA-2026:86618 Released 2026-10-21 · Red Hat rating CriticalNew container image: rhceph-9.2
- Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
- RHSA-2026:83622 Released 2026-10-15 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2026:83619 Released 2026-10-15 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.36 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
Show 29 more Red Hat advisories
- RHSA-2026:41944 Released 2026-07-20 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
- RHSA-2026:41941 Released 2026-07-20 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
- RHSA-2026:40984 Released 2026-07-16 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
- RHSA-2026:40945 Released 2026-07-16 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
- RHSA-2026:40118 Released 2026-07-15 · Red Hat rating ImportantRed Hat Edge Manager Version 1.1.3 Security Update
- Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
- RHSA-2026:36651 Released 2026-07-08 · Red Hat rating ImportantRed Hat Edge Manager Version 1.0.3 Security Update
- Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
- RHSA-2026:33371 Released 2026-06-30 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.18 security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-rt-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-services-3.4.10-4.SP2_redhat_00004.1.el7eap +7
- RHSA-2026:26214 Released 2026-06-16 · Red Hat rating ImportantGeneral availability of the satellite/iop-advisor-frontend-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
- RHSA-2026:26211 Released 2026-06-16 · Red Hat rating ImportantGeneral availability of the satellite/iop-remediations-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
- RHSA-2026:19712 Released 2026-05-20 · Red Hat rating CriticalRHOAI 3.3.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
- RHSA-2026:14774 Released 2026-05-13 · Red Hat rating ImportantOpenShift Container Platform 4.15.64 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kube-metrics-server-rhel8 +47
- RHSA-2026:16874 Released 2026-05-13 · Red Hat rating ImportantNetwork Observability 1.11.2 for OpenShift
- Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +1
- RHSA-2026:15091 Released 2026-05-12 · Red Hat rating ImportantOpenShift Container Platform 4.14.65 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2026:13512 Released 2026-05-04 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.28-3.el8ap, automation-gateway-proxy-2.5.10-5.el8ap, automation-gateway-proxy-server-2.5.10-5.el8ap +19
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.28-3.el9ap, automation-gateway-proxy-2.6.14-2.el9, automation-gateway-proxy-server-2.6.14-2.el9 +19
- RHSA-2026:10093 Released 2026-04-29 · Red Hat rating ImportantOpenShift Container Platform 4.19.29 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9, registry.redhat.io/openshift4/ose-powervs-block-csi-driver-rhel9-operator
- RHSA-2026:9742 Released 2026-04-22 · Red Hat rating CriticalRed Hat Developer Hub 1.8.6 release.
- Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:7314 Released 2026-04-09 · Red Hat rating ImportantRed Hat Quay 3.14.7
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:6802 Released 2026-04-07 · Red Hat rating ImportantRed Hat Developer Hub 1.9.3 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:6568 Released 2026-04-03 · Red Hat rating ImportantRed Hat Quay 3.15.4
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:6567 Released 2026-04-03 · Red Hat rating ImportantRed Hat Quay 3.16.3
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:6497 Released 2026-04-02 · Red Hat rating ImportantRed Hat Quay 3.16.3
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:5910 Released 2026-04-02 · Red Hat rating ImportantOpenShift Container Platform 4.16.59 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:6404 Released 2026-04-01 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/gateway-rhel9, registry.redhat.io/ansible-automation-platform-26/hub-rhel9, registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9 +2
- RHSA-2026:5907 Released 2026-04-01 · Red Hat rating ImportantOpenShift Container Platform 4.17.52 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/ose-cluster-kube-controller-manager-rhel9-operator, registry.redhat.io/openshift4/ose-ironic-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:6309 Released 2026-03-31 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/gateway-rhel9, registry.redhat.io/ansible-automation-platform-26/hub-rhel9, registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9 +2
- RHSA-2026:6277 Released 2026-03-31 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-gateway-proxy-2.6.14-1.el9, automation-gateway-proxy-server-2.6.14-1.el9, automation-platform-ui-2.6.7-1.el9ap +1
- RHSA-2026:6192 Released 2026-03-30 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.27.0 Release.
- Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
- RHSA-2026:5807 Released 2026-03-25 · Red Hat rating ImportantRHOAI 2.16.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +12
- RHSA-2026:5168 Released 2026-03-19 · Red Hat rating ImportantRed Hat Quay 3.9.19
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Confidential Compute Attestation | Affected | No fix planned: Will not fix |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Connectivity Link 1 | Affected | No fix planned: Will not fix |
| Red Hat Data Grid 8 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 2 | Affected | No fix planned: Will not fix |
| streams for Apache Kafka 3 | Affected | No fix planned: Will not fix |
| Network Observability (NETOBSERV) 1.11.0 | Fixed | RHSA-2026:16874 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:13512 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:6309 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:6277 |
| Red Hat Ceph Storage 9.2 | Fixed | RHSA-2026:86618 |
| Red Hat Developer Hub 1.8 | Fixed | RHSA-2026:9742 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:6802 |
| Red Hat Edge Manager 1.0 | Fixed | RHSA-2026:36651 |
| Red Hat Edge Manager 1.1 | Fixed | RHSA-2026:40118, RHSA-2026:40945 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2026:33371 |
| Red Hat OpenShift AI 2.16 | Fixed | RHSA-2026:5807 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:19712 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2026:15091 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2026:14774 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:5910 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:5907 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:10093 |
| Red Hat OpenShift Dev Spaces 3.27 | Fixed | RHSA-2026:6192 |
| Red Hat Openshift Data Foundation 4.16 | Fixed | RHSA-2026:83619 |
| Red Hat Openshift Data Foundation 4.17 | Fixed | RHSA-2026:83622 |
| Red Hat Openshift Data Foundation 4.18 | Fixed | RHSA-2026:41941 |
| Red Hat Openshift Data Foundation 4.19 | Fixed | RHSA-2026:41944 |
| Red Hat Openshift Data Foundation 4.20 | Fixed | RHSA-2026:40984 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:7314 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:6568 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:6497, RHSA-2026:6567 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:5168 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:26211, RHSA-2026:26214 |
Not affected: 60 products
- Cryostat 4
- Gatekeeper 3
- Multicluster Engine for Kubernetes
- Network Observability (NETOBSERV) 1.11.0
- Network Observability Operator
- Node HealthCheck Operator
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 10
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Build of Keycloak
- Red Hat Ceph Storage 9.2
- Red Hat Data Grid 8
- Red Hat Developer Hub 1.8
- Red Hat Developer Hub 1.9
- Red Hat Directory Server 11
- Red Hat Directory Server 12
- Red Hat Directory Server 13
- Red Hat Edge Manager 1.0
- Red Hat Edge Manager 1.1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.16
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces 3.27
- Red Hat Openshift Data Foundation 4.16
- Red Hat Openshift Data Foundation 4.17
- Red Hat Openshift Data Foundation 4.18
- Red Hat Openshift Data Foundation 4.19
- Red Hat Openshift Data Foundation 4.20
- Red Hat Process Automation 7
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.9
- Red Hat Satellite 6
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- Red Hat build of OptaPlanner 8
- streams for Apache Kafka 2
Timeline
- 2026-10-02 Threatist record created from CVE-2025-69873
- 2026-10-03 Alias added: GHSA-2g4f-4pwh-qvx6
- 2026-10-16 Fix available: RHSA-2026:83619 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83622 · Red Hat
- 2026-10-16 Fix available: Red Hat Openshift Data Foundation 4.16, Red Hat Openshift Data Foundation 4.17 · Red Hat
- 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
- 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat
References
Advisory 2
Other 9
- https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md
- https://github.com/github/advisory-database/pull/6991
- https://github.com/ajv-validator/ajv/pull/2588
- https://github.com/ajv-validator/ajv/releases/tag/v6.14.0
- https://github.com/ajv-validator/ajv/pull/2590
- https://github.com/ajv-validator/ajv/pull/2586
- https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5
- https://github.com/ajv-validator/ajv
- https://github.com/ajv-validator/ajv/releases/tag/v8.18.0
More ajv.js vulnerabilities
- TI-2020-12113 An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator)… CVSS 3.1MEDIUM 5.6
Sources
- CVE-2025-69873 · CVE Program
- CVE-2025-69873 · NVD
- FIRST EPSS
- GHSA-2g4f-4pwh-qvx6 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-69873 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences