Description
ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation.
Recommendation
Update the ajv package to the latest compatible version. Followings are version details:
Affected version(s): **< 6.14.0 >= 7.0.0-alpha.0, < 8.18.0** Patched version(s): **6.14.0 8.18.0**
References
Could your website be exposed too?
SmartScanner can check your website for ajv has ReDoS when using `$data` option and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter - vega - CVE-2025-26619
- @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtrack - CVE-2025-25289
- matrix-js-sdk has insufficient validation when considering a room to be upgraded by another - CVE-2025-59160
- @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Back - CVE-2025-25288
You might also like:
See something that needs correcting? Let us knowUpdated March 02, 2026