Medium, CVSS 5.3npmAmendedPublished
@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
CVE-2025-25289 · GHSA-xx4v-prfh-6cgc
- Affected
- npm @octokit/request-error >= 1.0.0, < 5.1.1; >= 6.0.0, < 6.1.7
- Fixed in
- 6.1.75.1.1· Vendor fix available
- Issue
- A Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and "@", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. Details The issue occurs at line 52 of iterator.ts in the @octokit/request-error repository. The vulnerability is caused by the use of an inefficient regular expression in the handling of the authorization header within the request processing logic: The regular expression / .$/ matches a space followed by any number of characters until the end of the line. This pattern is vulnerable to Regular Expression Denial of Service (ReDoS) when processing specially crafted input. Specifically, an attacker can send an authorization header…
Recommended action: Upgrade to 6.1.7 or 5.1.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.