SB2026030610 - Inefficient regular expression complexity in ajv

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026030610

SB2026030610 - Inefficient regular expression complexity in ajv

Published: March 6, 2026

Security Bulletin ID SB2026030610
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Inefficient regular expression complexity (CVE-ID: CVE-2025-69873)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to the pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation, when the $data option is enabled. A local user can can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.


Remediation

Install update from vendor's website.

References