Executive brief
@octokit/endpoint is a widely-used JavaScript library that wraps REST APIs, including GitHub's API, to simplify API request handling. A flaw in its URL parsing logic allows attackers to craft malicious input that causes the application to hang indefinitely with high CPU usage, disrupting service to legitimate users.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the parse.ts file at line 62, where the regex /[\w-]+(?=-preview)/g suffers from catastrophic backtracking. When the headers.accept field is populated with a long string of characters followed by a hyphen (e.g., 100,000 repetitions of 'A' followed by '-'), the regex engine backtracks excessively, causing CPU to spike and the application to become unresponsive. The vulnerability is triggered when endpoint.parse(options) is called with specific payloads: a URL ending in "/graphql", a mediaType.previews array with values, and a crafted accept header string. The attack requires no authentication. Patches are available in versions 9.0.6 and 10.1.3 or later, which replace the vulnerable regex with an optimized one: (?<![\w-])[\w-]+(?=-preview)
Affected products
- octokit endpoint >= 9.0.5
Timeline
- 2025-02-14: disclosed
- 2025-02-14: patched: Fixed in versions 9.0.6 and >= 10.1.3