chore(dependencies): update dependency ajv to v6.14.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ajv (source)	6.12.6 → 6.14.0

---

ajv has ReDoS when using $data option

CVE-2025-69873 / GHSA-2g4f-4pwh-qvx6

More information

Details

ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-69873
• https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md
• https://github.com/ajv-validator/ajv/pull/2586
• https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5
• https://github.com/ajv-validator/ajv/releases/tag/v8.18.0
• https://github.com/ajv-validator/ajv/pull/2588
• https://github.com/ajv-validator/ajv/releases/tag/v6.14.0
• https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
• https://github.com/ajv-validator/ajv/pull/2590
• https://github.com/github/advisory-database/pull/6991

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ajv-validator/ajv (ajv)

v6.14.0

Compare Source

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.