CVE-2026-84504

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

CVE-2026-84504

A flaw was found in fastify. An authenticated low-privilege caller can exploit a vulnerability where the framework incorrectly processes the result of an Ajv asynchronous async validator. If a request body contains a root-level property named 'value', fastify replaces the entire request body with...

CVE-2026-84504

fastify versions before 5.12.2 are vulnerable to a request body replacement flaw caused by an Ajv async validator result collision. When a request that passes its route schema contains a root-level property named value, fastify treats that property as the value result protocol used by custom vali...

EUVD-2026-70984

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

org.webjars.npm:ajv (>=8.17.1, <=8.20.0), org.webjars.npm:ajv-formats (>=2.1.1, <=3.0.1) +19 more potentially affected by CVE-2026-84292 via org.webjars.npm:fast-uri (3.1.5)

org.webjars.npm:fast-uri MAVEN version 3.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:fast-uri and may be impacted: - org.webjars.npm:ajv =8.17.1, =2.1.1, =0.1902.8, =19.2.8, =19.2.8, =2.0.44, =0.10.434, =0.3.16, =0.10.14, =0.25....

CVE-2026-0915-json-Patch.-V2.0

Uploading 1000000837.png… CVE-2026-0915-json-Patch.-V2.0 Patch the Bug - glibc 🔒 Correctif de sécurité du validateur JSON Solution de niveau entreprise pour CVE-2026-0915 - Protège contre l'analyse JSON non sécurisée grâce à une validation stricte des schémas. 🚨 Avis de sécurité Ce correctif...

CVE-2026-18504

fastify versions before 5.12.1 suffer a schema validation bypass: when a route schema targets a root primitive (e.g., integer), Ajv coerces the input type but Fastify passes the original uncoerced value to handlers, letting invalid data reach application logic. Upgrade to 5.12.1; no workarounds e...

PT-2026-77312

Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.1 Description A schema validation bypass occurs when a request body schema targets a root primitive value. When validating a top-level primitive, such as an integer, Ajv a JSON schema validator may coerce a JSON...

CLSA-2026-1774570936 TuxCare security update for ajv (4 CVEs)

TuxCare rebuilt ajv to address 4 CVEs. Fixed in 6.14.0-tuxcare.1...

ROOT-APP-NPM-CVE-2025-69873 CVE-2025-69873 in @rootio/ajv - Patched by Root

Root has patched CVE-2025-69873 in the @rootio/ajv package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2020-15366 CVE-2020-15366 in @rootio/ajv - Patched by Root

Root has patched CVE-2020-15366 in the @rootio/ajv package for Root:npm. Multiple fixed versions available...

Security Bulletin: Multiple Vulnerabilities in IBM Event Processing

Summary Multiple vulnerabilities were addressed. Vulnerability Details CVEID:CVE-2025-69873 DESCRIPTION: ajv Another JSON Schema Validator before 8.18.0 is vulnerable to Regular Expression Denial of Service ReDoS when the $data option is enabled. The pattern keyword accepts runtime data via JSON...

Security Bulletin: Vulnerability in ajv affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in ajv has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.10.0 Vulnerability Details CVEID:CVE-2025-69873 DESCRIPTION: ajv Another JSON Schema Validator before 8.18.0 is vulnerable to Regular Expression Denial of Service ReDoS when the $data option is...

ajv: ReDoS via $data reference

A flaw was found in ajv. When the $data option is enabled, the value of the pattern keyword is passed directly to the JavaScript RegExp constructor without sufficient validation. An attacker able to supply a malicious regular expression pattern can trigger a ReDoS Regular Expression Denial of...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses ajv-6.12.6.tgz which is vulnerable to CVE-2025-69873.

Summary IBM Maximo Application Suite - Monitor Component uses ajv-6.12.6.tgz which is vulnerable to CVE-2025-69873. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2025-69873 DESCRIPTION: ajv Another JSON Schema Validator before 8.18.0 is vulnerabl...

Security Bulletin: IBM Maximo Application Suite - Manage Component uses ajv-6.12.6 in multiple applications which is vulnerable CVE-2025-69873

Summary IBM Maximo Application Suite - Manage Component uses ajv-6.12.6 in multiple applications which is vulnerable CVE-2025-69873 Vulnerability Details CVEID:CVE-2025-69873 DESCRIPTION: ajv Another JSON Schema Validator before 8.18.0 is vulnerable to Regular Expression Denial of Service ReDoS...

Denial Of Service (DoS)

ajv is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to passing attacker-controlled values from $data references directly into the JavaScript RegExp constructor without validation. This allowing malicious regex patterns that trigger catastrophic backtracking a...

CVE-2025-69873

A flaw was found in ajv. When the $data option is enabled, the value of the pattern keyword is passed directly to the JavaScript RegExp constructor without sufficient validation. An attacker able to supply a malicious regular expression pattern can trigger a ReDoS Regular Expression Denial of...

1-sep-ui (>=0.0.1, <=0.0.2), 3d-crystal-model (0.1.0) +7232 more potentially affected by CVE-2025-69873 via ajv (>=6.0.0, <=6.12.6)

ajv NPM version =6.0.0, =0.0.1, =1.0.23, =0.0.1, =1.0.0, =1.0.0, =6.0.0, =0.0.2, =1.0.0, =0.0.10, =0.0.3, =1.0.6, =2.2.0 and more Source cves: CVE-2025-69873 Source advisory: OSV:GHSA-2G4F-4PWH-QVX6...