Regular expression denial of service in octokit request.js
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
@octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to versions 9.2.1 and 8.4.1, the regular expression `/<([^>]+)>; rel="deprecation"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. An attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability. Versions 9.2.1 and 8.4.1 fix the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| octokit | request.js | 1.0.0 to before 9.2.1 | 9.2.1 | Patch available | CNA |
| — | @octokit/request (npm) | 9.0.0-beta.1 to before 9.2.1 | 9.2.1 | Patch available | GHSA-rmvr-2pp2-xj38 |
| — | @octokit/request (npm) | 1.0.0 to before 8.4.1 | 8.4.1 | Patch available | GHSA-rmvr-2pp2-xj38 |
- request.js Vendoroctokit Affected 1.0.0 to before 9.2.1 Fixed in 9.2.1 Patch available CNA
- @octokit/request (npm) Vendor— Affected 9.0.0-beta.1 to before 9.2.1 Fixed in 9.2.1 Patch available GHSA-rmvr-2pp2-xj38
- @octokit/request (npm) Vendor— Affected 1.0.0 to before 8.4.1 Fixed in 8.4.1 Patch available GHSA-rmvr-2pp2-xj38
Remediation
- Fix · CNA request.js (octokit) Fixed in 9.2.1
- Fix · GHSA-rmvr-2pp2-xj38 @octokit/request (npm) Fixed in 9.2.1 Advisory →
- Fix · GHSA-rmvr-2pp2-xj38 @octokit/request (npm) Fixed in 8.4.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Multicluster Engine for Kubernetes | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix planned: Will not fix |
| Red Hat Developer Hub 1 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2025-25290
- 2026-10-03 Alias added: GHSA-rmvr-2pp2-xj38
- 2026-10-27 Affected versions changed · Red Hat
References
Other 7
- https://github.com/octokit/request.js/security/advisories/GHSA-rmvr-2pp2-xj38
- https://github.com/octokit/request.js/commit/34ff07ee86fc5c20865982d77391bc910ef19c68
- https://github.com/octokit/request.js/commit/356411e3217019aa9fc8a68f4236af82490873c2
- https://github.com/octokit/request.js/commit/6bb29ba92a52f7bf94469c3433707c682c17126c
- https://github.com/octokit/request.js/releases/tag/v8.4.1
- https://github.com/octokit/request.js/releases/tag/v9.2.1
- https://github.com/octokit/request.js
More octokit vulnerabilities
- TI-2025-18943 Regular expression denial of service in octokit request-error.js CVSS 3.1MEDIUM 5.3
- TI-2025-18942 Regular expression denial of service in octokit plugin-paginate-rest.js CVSS 3.1MEDIUM 5.3
- TI-2025-18939 @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVSS 3.1MEDIUM 5.3
- TI-2023-27674 Unauthenticated Denial of Service in the octokit/webhooks library CVSS 3.1HIGH 7.5
- TI-2022-13116 Octokit gem published with world-writable files CVSS 3.1LOW 3.3
- TI-2022-13115 Octopoller gem published with world-writable files CVSS 3.1LOW 3.3
Sources
- CVE-2025-25290 · CVE Program
- CVE-2025-25290 · NVD
- FIRST EPSS
- GHSA-rmvr-2pp2-xj38 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-25290 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences