TI-2025-18943 Aliases CVE-2025-25289 GHSA-xx4v-prfh-6cgc

Regular expression denial of service in octokit request-error.js

MEDIUM 63CWE-1333Published 2025-02-14 · Updated 2025-02-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

@octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and "@", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. Version 6.1.7 contains a fix for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00628 50th percentileScored 2026-11-07

Fix Partial request-error.js (octokit): 6.1.7@octokit/request-error (npm): 5.1.1, 6.1.7Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
octokit	request-error.js	1.0.0 to before 6.1.7	6.1.7	Patch available	CNA
—	@octokit/request-error (npm)	1.0.0 to before 5.1.1	5.1.1	Patch available	GHSA-xx4v-prfh-6cgc
—	@octokit/request-error (npm)	6.0.0 to before 6.1.7	6.1.7	Patch available	GHSA-xx4v-prfh-6cgc

request-error.js Vendoroctokit Affected 1.0.0 to before 6.1.7 Fixed in 6.1.7 Patch available CNA
@octokit/request-error (npm) Vendor— Affected 1.0.0 to before 5.1.1 Fixed in 5.1.1 Patch available GHSA-xx4v-prfh-6cgc
@octokit/request-error (npm) Vendor— Affected 6.0.0 to before 6.1.7 Fixed in 6.1.7 Patch available GHSA-xx4v-prfh-6cgc

Remediation

Fix · CNA request-error.js (octokit) Fixed in 6.1.7
Fix · GHSA-xx4v-prfh-6cgc @octokit/request-error (npm) Fixed in 5.1.1 Advisory →
Fix · GHSA-xx4v-prfh-6cgc @octokit/request-error (npm) Fixed in 6.1.7 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Developer Hub 1	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-25289
2026-10-03 Alias added: GHSA-xx4v-prfh-6cgc
2026-10-27 Affected versions changed · Red Hat
2026-10-30 EPSS moved to the 50th–90th percentile

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-25289

Other 4

TI-2025-18944 Regular expression denial of service in octokit request.js CVSS 3.1MEDIUM 5.3
TI-2025-18942 Regular expression denial of service in octokit plugin-paginate-rest.js CVSS 3.1MEDIUM 5.3
TI-2025-18939 @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVSS 3.1MEDIUM 5.3
TI-2023-27674 Unauthenticated Denial of Service in the octokit/webhooks library CVSS 3.1HIGH 7.5
TI-2022-13116 Octokit gem published with world-writable files CVSS 3.1LOW 3.3
TI-2022-13115 Octopoller gem published with world-writable files CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences