Executive brief
@octokit/request is a JavaScript library used by applications to interact with the GitHub API. A malicious HTTP response containing a specially crafted link header can cause the library to consume excessive CPU resources through a regular expression denial-of-service attack, making applications using this library unresponsive or causing them to crash.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the fetchWrapper function's regex pattern `/<([^>]+)>; rel="deprecation"/`, which is used to parse link headers in HTTP responses. The pattern is vulnerable to catastrophic backtracking when processing malicious input, such as a link header containing 100,000+ consecutive `<` characters. An attacker can exploit this by crafting an HTTP response with a malicious link header, causing the regex engine to perform extensive backtracking and exhaust server CPU resources. No authentication is required; the attack is triggered via network-reachable HTTP responses. The vulnerability affects versions >=1.0.0, and patches are available in version >=9.2.1.
Affected products
- Octokit @octokit/request >=1.0.0
Timeline
- 2025-02-14: disclosed: Vulnerability published as GHSA-rmvr-2pp2-xj38 and CVE-2025-25290
- 2025-02-14: patched: Patched in @octokit/request v9.2.1