Medium, CVSS 5.3npmAmendedPublished
@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
CVE-2025-25285 · GHSA-x4c5-c7rf-jjgv
- Affected
- npm @octokit/endpoint >= 9.0.5, < 9.0.6; >= 10.0.0, < 10.1.3
- Fixed in
- 10.1.39.0.6· Vendor fix available
- Issue
- By crafting specific options parameters, the endpoint.parse(options) call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. Details The issue occurs in the parse function within the parse.ts file of the npm package @octokit/endpoint. The specific code is located at the following link: https://github.com/octokit/endpoint.js/blob/main/src/parse.ts, at line 62: The regular expression /[\w-]+(?=-preview)/g encounters a backtracking issue when it processes a large number of characters followed by the - symbol. e.g., the attack string: PoC The gist Here is the reproduction process for the vulnerability: 1. run npm i @octokit/endpoint 2. Move poc.js to the root directory of the same level as README.md 3. run node poc.js result: 4. then the program will be stuck forever with high CPU usage 1. Import the endpoint module: First, import the endpoint module from the npm package…
Recommended action: Upgrade to 10.1.3 or 9.0.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.