Skip to content

fix(aws-cdk-lib): upgrade version of ajv that triggers CVE scanners#37022

Merged
mergify[bot] merged 4 commits intomainfrom
huijbers/override-ajv
Feb 19, 2026
Merged

fix(aws-cdk-lib): upgrade version of ajv that triggers CVE scanners#37022
mergify[bot] merged 4 commits intomainfrom
huijbers/override-ajv

Conversation

@rix0rrr
Copy link
Copy Markdown
Contributor

@rix0rrr rix0rrr commented Feb 18, 2026 •
edited
Loading

Upgrade ajv to 8.18.0, which is version that is not vulnerable to a ReDoS attack anymore.

Note that CDK never had an actual vulnerability in the first place because the input was not attacker-controlled, but CVE scanners will flag this finding regardless.

This overrides the package in our repository, the dependency that gets installed at build time is bundled into the final aws-cdk-lib tarball.

Closes #36989

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@rix0rrr
fix(aws-cdk-lib): override version of ajv that triggers CVE scanners
6a1bc02 
Upgrade `ajv` to `8.18.0`, which is version that is not vulnerable to a
ReDoS attack anymore.

Note that CDK never had an actual vulnerability in the first place
because the input was not attacker-controlled, but CVE scanners will
flag this finding regardless.
@rix0rrr rix0rrr requested a review from a team February 18, 2026 14:48
@aws-cdk-automation aws-cdk-automation requested a review from a team February 18, 2026 14:48
@github-actions github-actions Bot added the p2 label Feb 18, 2026
@mergify mergify Bot added the contribution/core This is a PR that came from AWS. label Feb 18, 2026
@github-actions github-actions Bot added bug This issue is a bug. effort/medium Medium work item – several days of effort p1 and removed p2 labels Feb 18, 2026
aws-cdk-automation
aws-cdk-automation previously requested changes Feb 18, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(This review is outdated)

@Abogical Abogical added pr-linter/exempt-test The PR linter will not require test changes pr-linter/exempt-integ-test The PR linter will not require integ test changes labels Feb 18, 2026
Abogical
Abogical previously requested changes Feb 18, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@Abogical Abogical left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is a build error related to ajv: https://github.com/aws/aws-cdk/actions/runs/22144520835/job/64017685124?pr=37022#step:9:578

@aws-cdk-automation aws-cdk-automation dismissed stale reviews from themself February 18, 2026 15:44

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

@pahud pahud mentioned this pull request Feb 18, 2026
Open
@jumic
Copy link
Copy Markdown
Contributor

jumic commented Feb 19, 2026

FYI - in case it is helpful: This error seams to be related to ajv upgrade from v6 to v8:
NOT SUPPORTED: option missingRefs. Pass empty schema with $id that should be ignored to ajv.addSchema.
See changelog, search for missingRefs.

In ajv there is a PR to fix this vulnerability also in v6. Maybe this helps to fix the issue in CDK as well (after a new v6 version is published).

@rix0rrr rix0rrr changed the title fix(aws-cdk-lib): override version of ajv that triggers CVE scanners fix(aws-cdk-lib): upgrade version of ajv that triggers CVE scanners Feb 19, 2026
@rix0rrr
Copy link
Copy Markdown
Contributor Author

rix0rrr commented Feb 19, 2026

We didn't actually need an override, the dependency of table -> ajv was a ^ so a simple refreshing of the lockfile was sufficient.

@rix0rrr rix0rrr requested a review from Abogical February 19, 2026 12:11
@rix0rrr rix0rrr dismissed Abogical’s stale review February 19, 2026 14:07

Your "change requested" was that the build doesn't pass. It passes now.

@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented Feb 19, 2026

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented Feb 19, 2026 •
edited
Loading

Merge Queue Status

Rule: default-squash

  • ✅ Entered queue — 2026-02-19 14:23 UTC
  • ✅ Checks passed · in-place
  • ✅ Merged — 2026-02-19 14:54 UTC · at 9677ef39df220964a29e59a9818552073116dabe

This pull request spent 31 minutes 22 seconds in the queue, including 31 minutes 11 seconds running CI.

Required conditions to merge

@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented Feb 19, 2026

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@mergify mergify Bot merged commit 45662ba into main Feb 19, 2026
17 of 18 checks passed
@mergify mergify Bot deleted the huijbers/override-ajv branch February 19, 2026 14:54
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Feb 19, 2026

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Feb 19, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@mrgrain mrgrain mrgrain approved these changes

@aws-cdk-automation aws-cdk-automation aws-cdk-automation left review comments

@Abogical Abogical Awaiting requested review from Abogical

Assignees

No one assigned

Labels

bug This issue is a bug. contribution/core This is a PR that came from AWS. effort/medium Medium work item – several days of effort p1 pr-linter/exempt-integ-test The PR linter will not require integ test changes pr-linter/exempt-test The PR linter will not require test changes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

CVE-2025-69873

5 participants

@rix0rrr @jumic @mrgrain @Abogical @aws-cdk-automation