Description
@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack. Version 11.4.1 contains a fix for the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| octokit | plugin-paginate-rest.js | >= 1.0.0, < 11.4.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | lerna | 8.2.1-r0 | — |
| Wolfi rolling | prism | 5.14.3-r1 | — |
| Wolfi rolling | renovate | 39.175.6-r0 | — |
| Wolfi rolling | tileserver-gl | 5.4.0-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @octokit/plugin-paginate-rest | >= 9.3.0-beta.1, < 11.4.1 | 11.4.1 | GHSA-h5c3-5r3r-rr8q |
| npm | @octokit/plugin-paginate-rest | >= 1.0.0, < 9.2.2 | 9.2.2 | GHSA-h5c3-5r3r-rr8q |