# What changed in ajv

> 6 changes in ajv 8 from its official release notes, upgrade guides and advisories: 2 breaking, 2 security. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/ajv/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## ajv 8

### Breaking changes

- Ajv adds support for Node.js 22 and 24, and drops support for Node.js 16 and 21. (8.20.0) — [release notes](https://github.com/ajv-validator/ajv/releases/tag/v8.20.0)
- Fixes Infinity and NaN serialization so they serialize to null. (8.18.0) — [release notes](https://github.com/ajv-validator/ajv/releases/tag/v8.18.0)

### Security

- Fixes prototype pollution via the format keyword when using a $data reference. (8.19.0) — [release notes](https://github.com/ajv-validator/ajv/releases/tag/v8.19.0)
- Uses the configured RegExp engine with the $data keyword to mitigate ReDoS attacks. (8.18.0) — [release notes](https://github.com/ajv-validator/ajv/releases/tag/v8.18.0), [security advisory](https://github.com/advisories/GHSA-2G4F-4PWH-QVX6)

### Performance

- Adds sideEffects: false to enable tree-shaking of the package. (8.18.0) — [release notes](https://github.com/ajv-validator/ajv/releases/tag/v8.18.0)

### Fixes and other changes

- Adds ES2022.RegExp support for RegExpIndicesArray. (8.20.0) — [release notes](https://github.com/ajv-validator/ajv/releases/tag/v8.20.0)