Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

ajv · denial of service

CVSS 3.1 2.9 LOWEUVD CVSS 3.1 7.5 CVSS 3.1 · [email protected] · Secondary 2.9 LOWCVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 HIGHCVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5 HIGHCVSS_V4 Publisher rating MODERATEFixed by ajv 8.18.0Fixed by ajv 6.14.0KEV status unknown

cve-program · CVE-2025-69873

Published

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

Read the publisher's advisory

euvd · EUVD-2025-207389

Published

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

Read the publisher's advisory

nvd · CVE-2025-69873

Published

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

Read the publisher's advisory

osv · GHSA-2g4f-4pwh-qvx6

Published

ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the `$data` option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax (`$data` reference), which is passed directly to the JavaScript `RegExp()` constructor without validation. An attacker can inject a malicious regex pattern (e.g., `\"^(a|a)*$\"`) combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with `$data`: true for dynamic schema validation.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2025-69873

Published

ajv

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "ajv",
                    "vendor": "ajv.js",
                    "versions": [
                        {
                            "lessThan": "6.14.0",
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver"
                        },
                        {
                            "lessThan": "8.17.2",
                            "status": "affected",
                            "version": "7.0.0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2025-207389

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Feb 11, 2026, 12:00:00 AM

dateUpdated: Sep 14, 2026, 12:04:32 PM

34 related source bulletins · separate from aliases

msrc_CVE-2025-69873: ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.

CVE-2025-69873

RHSA-2026:41944: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update

CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-66031 · CVE-2025-68157 · CVE-2025-68458 · CVE-2025-69873 · CVE-2026-4800 · CVE-2026-25128 · CVE-2026-25896 · CVE-2026-26278 · CVE-2026-26996 · CVE-2026-27904 · CVE-2026-27942 · CVE-2026-29063 · CVE-2026-33036 · CVE-2026-33186 · CVE-2026-34986 · CVE-2026-48779

RHSA-2026:83619: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.36 security, enhancement & bug fix update

CVE-2025-13465 · CVE-2025-15284 · CVE-2025-61726 · CVE-2025-66031 · CVE-2025-68157 · CVE-2025-68458 · CVE-2025-69873 · CVE-2026-4800 · CVE-2026-26996 · CVE-2026-27904 · CVE-2026-33186 · CVE-2026-33814 · CVE-2026-34986

RHSA-2026:86618: Red Hat Security Advisory: New container image: rhceph-9.2

CVE-2023-46159 · CVE-2024-47866 · CVE-2024-48916 · CVE-2024-55565 · CVE-2025-12816 · CVE-2025-15599 · CVE-2025-26791 · CVE-2025-30156 · CVE-2025-50181 · CVE-2025-50182 · CVE-2025-58754 · CVE-2025-59343 · CVE-2025-62718 · CVE-2025-66030 · CVE-2025-66035 · CVE-2025-66412 · CVE-2025-69873 · CVE-2026-0540 · CVE-2026-21441 · CVE-2026-22610 · CVE-2026-25639 · CVE-2026-26996 · CVE-2026-27903 · CVE-2026-27904 · CVE-2026-27970 · CVE-2026-32141 · CVE-2026-33228 · CVE-2026-33671 · CVE-2026-33672 · CVE-2026-33891 · CVE-2026-33894 · CVE-2026-33895 · CVE-2026-33896 · CVE-2026-39865 · CVE-2026-40175 · CVE-2026-40895 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-41305 · CVE-2026-42033 · CVE-2026-42034 · CVE-2026-42035 · CVE-2026-42036 · CVE-2026-42037 · CVE-2026-42038 · CVE-2026-42039 · CVE-2026-42040 · CVE-2026-42041 · CVE-2026-42042 · CVE-2026-42043 · CVE-2026-42044 · CVE-2026-50152 · CVE-2026-58224

RHSA-2026:5910: Red Hat Security Advisory: OpenShift Container Platform 4.16.59 bug fix and security update

CVE-2025-69873

RHSA-2026:33371: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.18 security update

CVE-2024-29371 · CVE-2025-9784 · CVE-2025-12543 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-23184 · CVE-2025-23368 · CVE-2025-66412 · CVE-2025-69873 · CVE-2026-1002 · CVE-2026-24842

RHSA-2026:40945: Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.3 Security Update

CVE-2025-13465 · CVE-2025-61729 · CVE-2025-68121 · CVE-2025-69873 · CVE-2026-4800 · CVE-2026-4926 · CVE-2026-6322 · CVE-2026-13676 · CVE-2026-22029 · CVE-2026-25679 · CVE-2026-29063 · CVE-2026-32141 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-33186 · CVE-2026-33810 · CVE-2026-33811 · CVE-2026-33816 · CVE-2026-39821 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39832 · CVE-2026-39835 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42508 · CVE-2026-46595

RHSA-2026:41941: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update

CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-47907 · CVE-2025-58183 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-66031 · CVE-2025-68157 · CVE-2025-68458 · CVE-2025-69873 · CVE-2026-4800 · CVE-2026-25896 · CVE-2026-26278 · CVE-2026-26996 · CVE-2026-27904 · CVE-2026-27942 · CVE-2026-29063 · CVE-2026-33036 · CVE-2026-33186 · CVE-2026-34986 · CVE-2026-48779

RHSA-2026:5807: Red Hat Security Advisory: RHOAI 2.16.4 - Red Hat OpenShift AI

CVE-2024-25621 · CVE-2025-6193 · CVE-2025-12060 · CVE-2025-12638 · CVE-2025-12816 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-66031 · CVE-2025-66418 · CVE-2025-66626 · CVE-2025-68156 · CVE-2025-69873 · CVE-2026-1526 · CVE-2026-1528 · CVE-2026-2229 · CVE-2026-25223 · CVE-2026-25639 · CVE-2026-29074 · CVE-2026-32141

RHSA-2026:15091: Red Hat Security Advisory: OpenShift Container Platform 4.14.65 bug fix and security update

CVE-2025-13465 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61731 · CVE-2025-61732 · CVE-2025-69873 · CVE-2026-25679 · CVE-2026-40175

RHSA-2026:26211: Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image

CVE-2025-69873

RHSA-2026:26214: Red Hat Security Advisory: General availability of the satellite/iop-advisor-frontend-rhel9 container image

CVE-2025-69873 · CVE-2026-6321 · CVE-2026-26996 · CVE-2026-27904 · CVE-2026-41680 · CVE-2026-42033 · CVE-2026-42035 · CVE-2026-42039 · CVE-2026-42041 · CVE-2026-42043 · CVE-2026-42044

RHSA-2026:6567: Red Hat Security Advisory: Red Hat Quay 3.16.3

CVE-2025-13465 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-68121 · CVE-2025-68158 · CVE-2025-69873 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26996 · CVE-2026-27628 · CVE-2026-27904 · CVE-2026-28498

RHSA-2026:9742: Red Hat Security Advisory: Red Hat Developer Hub 1.8.6 release.

CVE-2025-62718 · CVE-2025-69534 · CVE-2025-69873 · CVE-2026-1525 · CVE-2026-1526 · CVE-2026-1528 · CVE-2026-2229 · CVE-2026-3118 · CVE-2026-4800 · CVE-2026-4926 · CVE-2026-25679 · CVE-2026-26996 · CVE-2026-27601 · CVE-2026-27904 · CVE-2026-29063 · CVE-2026-29074 · CVE-2026-29186 · CVE-2026-32141 · CVE-2026-33036 · CVE-2026-33228 · CVE-2026-33891 · CVE-2026-33894 · CVE-2026-33895 · CVE-2026-33896 · CVE-2026-39983 · CVE-2026-40175

RHSA-2026:40984: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update

CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-66031 · CVE-2025-68157 · CVE-2025-68458 · CVE-2025-69873 · CVE-2026-4800 · CVE-2026-22029 · CVE-2026-25128 · CVE-2026-25896 · CVE-2026-26278 · CVE-2026-26996 · CVE-2026-27904 · CVE-2026-27942 · CVE-2026-29063 · CVE-2026-33036 · CVE-2026-33186 · CVE-2026-33815 · CVE-2026-33816 · CVE-2026-34986 · CVE-2026-48779

RHSA-2026:7314: Red Hat Security Advisory: Red Hat Quay 3.14.7

CVE-2025-69873 · CVE-2026-27962

RHSA-2026:16874: Red Hat Security Advisory: Network Observability 1.11.2 for OpenShift

CVE-2025-62718 · CVE-2025-69873 · CVE-2026-4800 · CVE-2026-25679 · CVE-2026-32280 · CVE-2026-32282 · CVE-2026-40175 · CVE-2026-40895 · CVE-2026-42033 · CVE-2026-42035 · CVE-2026-42039 · CVE-2026-42041 · CVE-2026-42043

RHSA-2026:6277: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

CVE-2025-61726 · CVE-2025-68121 · CVE-2025-69873 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-27904 · CVE-2026-29074

RHSA-2026:6309: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

CVE-2025-69223 · CVE-2025-69873 · CVE-2026-1615 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-28498 · CVE-2026-28802 · CVE-2026-29074 · CVE-2026-30827 · CVE-2026-30922

RHSA-2026:5168: Red Hat Security Advisory: Red Hat Quay 3.9.19

CVE-2025-61726 · CVE-2025-68121 · CVE-2025-69873 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26996 · CVE-2026-27628 · CVE-2026-27904 · CVE-2026-28802

RHSA-2026:83622: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update

CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-58183 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-66031 · CVE-2025-68157 · CVE-2025-68458 · CVE-2025-69873 · CVE-2026-4800 · CVE-2026-6321 · CVE-2026-22029 · CVE-2026-26996 · CVE-2026-27904 · CVE-2026-29063 · CVE-2026-33186

RHSA-2026:40118: Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.3 Security Update

CVE-2025-13465 · CVE-2025-61729 · CVE-2025-68121 · CVE-2025-69873 · CVE-2026-4800 · CVE-2026-4926 · CVE-2026-6322 · CVE-2026-13676 · CVE-2026-22029 · CVE-2026-25679 · CVE-2026-29063 · CVE-2026-32141 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-33186 · CVE-2026-33810 · CVE-2026-33811 · CVE-2026-33816 · CVE-2026-39821 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39832 · CVE-2026-39835 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42508 · CVE-2026-46595

RHSA-2026:6497: Red Hat Security Advisory: Red Hat Quay 3.16.3

CVE-2025-13465 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-68121 · CVE-2025-68158 · CVE-2025-69873 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26996 · CVE-2026-27628 · CVE-2026-27904 · CVE-2026-28498

RHSA-2026:14774: Red Hat Security Advisory: OpenShift Container Platform 4.15.64 bug fix and security update

CVE-2025-13465 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61731 · CVE-2025-61732 · CVE-2025-65637 · CVE-2025-69873 · CVE-2026-25679 · CVE-2026-40175

RHSA-2026:6568: Red Hat Security Advisory: Red Hat Quay 3.15.4

CVE-2024-34156 · CVE-2024-45337 · CVE-2024-45338 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61729 · CVE-2025-68121 · CVE-2025-68158 · CVE-2025-69873 · CVE-2026-4598 · CVE-2026-4599 · CVE-2026-4600 · CVE-2026-4601 · CVE-2026-4602 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26996 · CVE-2026-27628 · CVE-2026-27904 · CVE-2026-28498 · CVE-2026-28802 · CVE-2026-29063 · CVE-2026-29074 · CVE-2026-30922 · CVE-2026-32597

RHSA-2026:5907: Red Hat Security Advisory: OpenShift Container Platform 4.17.52 bug fix and security update

CVE-2025-65637 · CVE-2025-69873 · CVE-2026-22797

RHSA-2026:13512: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

CVE-2025-69534 · CVE-2025-69873 · CVE-2026-6266 · CVE-2026-23490 · CVE-2026-25679 · CVE-2026-26007 · CVE-2026-27459 · CVE-2026-27606 · CVE-2026-29074 · CVE-2026-30922 · CVE-2026-32597 · CVE-2026-39373

RHSA-2026:6192: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.27.0 Release.

CVE-2025-13465 · CVE-2025-54386 · CVE-2025-61726 · CVE-2025-61728 · CVE-2025-61729 · CVE-2025-64756 · CVE-2025-68121 · CVE-2025-69873 · CVE-2026-1002 · CVE-2026-22045 · CVE-2026-23745 · CVE-2026-23950 · CVE-2026-24049 · CVE-2026-24842 · CVE-2026-25223 · CVE-2026-25639 · CVE-2026-25949 · CVE-2026-26960 · CVE-2026-26996

RHSA-2026:6802: Red Hat Security Advisory: Red Hat Developer Hub 1.9.3 release.

CVE-2025-61140 · CVE-2025-69873 · CVE-2026-1615 · CVE-2026-2359 · CVE-2026-3304 · CVE-2026-3520 · CVE-2026-24046 · CVE-2026-25153 · CVE-2026-25639 · CVE-2026-25679 · CVE-2026-25896 · CVE-2026-26278 · CVE-2026-27606 · CVE-2026-27942 · CVE-2026-33186

RHSA-2026:10093: Red Hat Security Advisory: OpenShift Container Platform 4.19.29 bug fix and security update

CVE-2025-69873 · CVE-2026-33186

RHSA-2026:19712: Red Hat Security Advisory: RHOAI 3.3.3 - Red Hat OpenShift AI

CVE-2025-6242 · CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-59057 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-62164 · CVE-2025-62718 · CVE-2025-64756 · CVE-2025-66031 · CVE-2025-66418 · CVE-2025-66448 · CVE-2025-66471 · CVE-2025-69223 · CVE-2025-69873 · CVE-2026-0846 · CVE-2026-0847 · CVE-2026-4800 · CVE-2026-21441 · CVE-2026-21884 · CVE-2026-22029 · CVE-2026-22778 · CVE-2026-23490 · CVE-2026-23745 · CVE-2026-24049 · CVE-2026-24486 · CVE-2026-24779 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-27893 · CVE-2026-28684 · CVE-2026-29063 · CVE-2026-29074 · CVE-2026-30922 · CVE-2026-31812 · CVE-2026-32597 · CVE-2026-32829 · CVE-2026-32981 · CVE-2026-33186 · CVE-2026-33231 · CVE-2026-33236 · CVE-2026-34986 · CVE-2026-40175 · CVE-2026-40192 · CVE-2026-40895

WID-SEC-W-2026-0935: Red Hat Ansible Automation Platform: Mehrere Schwachstellen

CVE-2025-69223 · CVE-2025-69873 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-29074 · CVE-2026-30827 · CVE-2026-30922 · CVE-2026-26007 · CVE-2026-1615 · CVE-2026-28498 · CVE-2026-28802

RHSA-2026:36651: Red Hat Security Advisory: Red Hat Edge Manager Version 1.0.3 Security Update

CVE-2025-13465 · CVE-2025-61729 · CVE-2025-68121 · CVE-2025-69873 · CVE-2026-4800 · CVE-2026-4926 · CVE-2026-6322 · CVE-2026-22029 · CVE-2026-25679 · CVE-2026-29063 · CVE-2026-32141 · CVE-2026-32280 · CVE-2026-33186 · CVE-2026-33810 · CVE-2026-33811 · CVE-2026-39821 · CVE-2026-39828 · CVE-2026-39829 · CVE-2026-39830 · CVE-2026-39832 · CVE-2026-39835 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42508 · CVE-2026-46595

RHSA-2026:6404: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update

CVE-2025-69223 · CVE-2025-69873 · CVE-2026-1615 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-28498 · CVE-2026-28802 · CVE-2026-29074 · CVE-2026-30827 · CVE-2026-30922

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-69873

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-1333 · CWE-400

Original publisher date fields

published: 2026-02-11T19:15:50.467

lastModified: 2026-09-10T13:17:29.420

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-2g4f-4pwh-qvx6

Published

ajv

npm

SEMVER · introduced 7.0.0-alpha.0 → fixed 8.18.0

ajv

npm

SEMVER · introduced 0 → fixed 6.14.0

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 17:25 UTC · 274 of 275 readable · 273 fully read · documentation 469/469 current