Packages

ajv

8.20.0 · 24 Apr 2026MIT233.1M / weekRepositoryHomepagenpmAtom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for ajv. It is read in your browser and sent nowhere.

LineNewestWhere it stands
8.20.0Safe from 8.18.0
7.2.41 open advisory, worst moderate · last release Mar 2021, no longer updated
6.15.0Safe from 6.14.0
5.5.226 open advisories, worst moderate · last release Dec 2017, no longer updated
  • Moderate
    ajv has ReDoS when using `$data` optionGHSA-2g4f-4pwh-qvx6 · 11 Feb 2026
    • 8.x8.0.0 – 8.17.1Fixed in 8.18.0
    • 7.x7.0.0 – 7.2.4No fix on 7.x · move to 8.18.0
    • 6.x6.0.0 – 6.12.6Fixed in 6.14.0
    • 5.x and older0.0.4 – 5.5.2No fix, no longer updated · move to 6.14.0
  • Moderate
    Prototype Pollution in AjvGHSA-v88g-cgmw-v5xw · 10 Feb 2022
    • 6.x6.0.0 – 6.12.2Fixed in 6.12.3
    • 5.x and older0.0.4 – 5.5.2No fix, no longer updated · move to 6.12.3

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.