CVE-2025-69873 describes a ReDoS vulnerability in ajv before version 8.18.0 when the $data option is enabled. The pattern keyword in JSON schema validation accepts dynamic data via JSON Pointer syntax, which is passed unchecked to the JavaScript RegExp() constructor. An attacker can exploit this by injecting a malicious regex pattern that triggers catastrophic backtracking, causing significant CPU resource consumption and denial of service. The vulnerability requires the $data option to be enabled and the ability to supply crafted input. The vulnerability has been assigned a CVSS v3 score of 7.5 by Red Hat, indicating important severity, although other sources list it as low severity. The vulnerability is fixed in ajv version 8.18.0.

An attacker able to supply a malicious regular expression pattern when the $data option is enabled can cause the application to become unresponsive due to excessive CPU consumption, resulting in a denial of service. The attack requires the ability to send crafted input to the application using ajv with $data: true. The impact is limited to availability with no confidentiality or integrity impact. The vulnerability can cause prolonged CPU blocking with relatively small payloads.

A fix is available in ajv version 8.18.0. Users should upgrade to this or a later version to remediate the vulnerability. If upgrading is not immediately possible, the vendor advisory recommends disabling the $data feature if it is not required. If $data must be used, strict validation of input fields referenced by the pattern keyword should be implemented to ensure only expected and safe characters are accepted.