AIKIDO-2026-273849

TL;DR

Ajv stores its registered formats in a plain JavaScript object, so a lookup by format name inherits properties from Object.prototype. When the $data option is enabled and a schema resolves the format keyword from a $data reference, an attacker-controlled value such as constructor, toString, or hasOwnProperty resolves to an inherited prototype function instead of undefined. Ajv then treats that inherited function as a format validator and invokes it, causing unexpected validation behavior or errors during validation. The fix stores the internal formats map as a null-prototype object (Object.create(null)) so prototype property names resolve to unknown formats.