A critical ReDoS vulnerability in the Ajv JSON schema validator allows unauthenticated attackers to cause complete service denial through malicious regex injection.

The vulnerability exists in the handling of the $data option where user-supplied patterns are passed to the JavaScript RegExp constructor without validation. An unauthenticated attacker can supply a crafted JSON payload that triggers catastrophic backtracking, resulting in extreme CPU consumption and system unavailability.

The ability to trigger a denial of service via a single API request poses a significant risk to application availability and infrastructure stability. With a CVSS score of 7.5, this vulnerability represents a high risk to business continuity, as it allows attackers to effectively knock services offline without requiring any authentication or elevated privileges.

Immediate Action: Update the Ajv package to version 6.14.0 or 8.18.0 depending on the major version currently deployed in your environment.

Proactive Monitoring: Monitor API endpoints for spikes in CPU utilization and anomalous request latency that may indicate ongoing ReDoS attempts.

Compensating Controls: Implement strict input validation or request size limits on API gateways to filter out excessively large or complex JSON payloads before they reach the validation layer.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the GitHub advisory and the researcher's disclosure.

Given the ease with which this vulnerability can be exploited to crash backend services, organizations using Ajv must prioritize upgrading to the patched versions immediately. If an immediate update is not feasible, ensure that input validation routines are hardened to reject potentially malicious regex patterns until the library can be updated.