Medium, CVSS 5.3npmAmendedPublished
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
CVE-2025-25288 · GHSA-h5c3-5r3r-rr8q
- Affected
- npm @octokit/plugin-paginate-rest >= 9.3.0-beta.1, < 11.4.1; >= 1.0.0, < 9.2.2
- Fixed in
- 11.4.19.2.2· Vendor fix available
- Issue
- For the npm package @octokit/plugin-paginate-rest, when calling octokit.paginate.iterator(), a specially crafted octokit instance—particularly with a malicious link parameter in the headers section of the request—can trigger a ReDoS attack. Details The issue occurs at line 39 of iterator.ts in the @octokit/plugin-paginate-rest repository. The relevant code is as follows: The regular expression /<([^]+);\srel="next"/ may lead to a potential backtracking vulnerability, resulting in a ReDoS (Regular Expression Denial of Service) attack. This could cause high CPU utilization and even service slowdowns or freezes when processing specially crafted Link headers. PoC The gist of PoC.js 1. run npm i @octokit/plugin-paginate-rest 2. run 'node poc.js' result: 3. then the program will stuck forever with high CPU usage Impact What kind of vulnerability is it? This is a Regular Expression Denial of Service (ReDoS) vulnerability, which occurs due to excessive backtracking in the regex…
Recommended action: Upgrade to 11.4.1 or 9.2.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.