Skip to content
OpenAdvisories
Medium · 5.3 CVE-2025-25290 EUVD-2025-4104GHSA-rmvr-2pp2-xj38

@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

Published Feb 14, 2025 · Updated Jan 16, 2026 · Assigned by GitHub_M

Description

@octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to versions 9.2.1 and 8.4.1, the regular expression `/<([^>]+)>; rel="deprecation"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. An attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability. Versions 9.2.1 and 8.4.1 fix the issue.

Affected products

VendorProductAffectedFixed
octokit request.js >= 1.0.0, < 9.2.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling lerna 8.2.1-r0 —
Wolfi rolling prism 5.14.3-r1 —
Wolfi rolling renovate 39.174.0-r0 —
Wolfi rolling tileserver-gl 5.4.0-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm @octokit/request >= 9.0.0-beta.1, < 9.2.1 9.2.1 GHSA-rmvr-2pp2-xj38
npm @octokit/request >= 1.0.0, < 8.4.1 8.4.1 GHSA-rmvr-2pp2-xj38

References