Vulnerabilities

TI-2025-18944 CVE-2025-25290 · GHSA-rmvr-2pp2-xj38

Regular expression denial of service in octokit request.js

MEDIUM 63

@octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00783 Published 2025-02-14 Partial fix · 9.2.1, 8.4.1 CWE-1333

TI-2025-18943 CVE-2025-25289 · GHSA-xx4v-prfh-6cgc

MEDIUM 63

@octokit/request-error is an error class for Octokit request errors.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00628 Published 2025-02-14 Partial fix · 6.1.7, 5.1.1 CWE-1333

TI-2025-18942 CVE-2025-25288 · GHSA-h5c3-5r3r-rr8q

MEDIUM 63

@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00628 Published 2025-02-14 Partial fix · 11.4.1, 9.2.2 CWE-1333

TI-2025-18939 CVE-2025-25285 · GHSA-x4c5-c7rf-jjgv

MEDIUM 63

@octokit/endpoint turns REST API endpoints into generic request options.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00628 Published 2025-02-14 Partial fix · 10.1.3, 9.0.6 CWE-1333

TI-2023-27674 CVE-2023-50728 · GHSA-pwfr-8pq7-x9qv

LOW 35

octokit/webhooks is a GitHub webhook events toolset for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00903 Published 2023-12-15 Fixed in 9.26.3, 10.9.2 +6 CWE-755

TI-2022-13115 CVE-2022-31071 · GHSA-26qj-cr27-r5c4

LOW 15

Octopoller is a micro gem for polling and retrying.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00223 Published 2022-06-15 Fixed in 0.3.0 CWE-276

TI-2022-13116 CVE-2022-31072 · GHSA-g28x-pgr3-qqx6

LOW 16

Octokit is a Ruby toolkit for the GitHub API.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00255 Published 2022-06-15 Fixed in 4.25.0 CWE-276