Skip to main content

Inefficient Regular Expression Complexity

CVE-2025-25285

Medium
5.3/10

Summary

The package @octokit/endpoint turns REST API endpoints into generic request options. In versions 9.0.5, and 10.0.0-beta.1 through 10.1.2, by crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the `parse` function within the `parse.ts` file.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

Advisory Timeline

  • Published