Skip to main content

Inefficient Regular Expression Complexity

CVE-2025-25288

Medium
5.3/10

Summary

The package @octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. In versions through 9.2.1 and 9.3.0-beta.1 through 11.4.0, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance, particularly with a malicious `link` parameter in the `headers` section of the `request` can trigger a ReDoS attack.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

Advisory Timeline

  • Published