Executive brief
@octokit/request-error is a JavaScript library used to handle HTTP request errors in GitHub API interactions. A Regular Expression Denial of Service (ReDoS) vulnerability in the authorization header processing allows attackers to send specially crafted headers that cause excessive CPU consumption, potentially freezing the server and disrupting API services.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in @octokit/request-error due to an inefficient regex pattern (/ .*$/) used to sanitize the authorization header at line 52 of iterator.ts. The pattern matches a space followed by any number of characters until the end of the line, but exhibits catastrophic backtracking when processing specially crafted input. An attacker can exploit this by sending an authorization header containing a long sequence of spaces followed by a newline and "@" character, causing the regex engine to consume excessive CPU resources and potentially freeze the application. No privileges or user interaction are required; exploitation occurs at the network layer during header processing. The vulnerability affects versions 1.0.0 through 5.1.0 and 6.0.0 through 6.1.6, with patches available in version 5.1.1 and 6.1.7 or later.
Affected products
- Octokit request-error >=1.0.0 to <5.1.1; >=6.0.0 to <6.1.7
Timeline
- 2025-02-14: disclosed
- 2025-02-14: patched: Patches released as version 5.1.1 and 6.1.7