CVE-2025-25285

@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the `parse` function within the `parse.ts` file of the npm package `@octokit/endpoint`. Version 10.1.3 contains a patch for the issue.

• CWE-1333

• https://github.com/octokit/endpoint.js/blob/main/src/parse.ts
• https://github.com/octokit/endpoint.js/commit/6c9c5be033c450d436efb37de41b6470c22f7db8
• https://github.com/octokit/endpoint.js/security/advisories/GHSA-x4c5-c7rf-jjgv

Published

Feb 14, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-2528Improper authorization in application password policy in Dev…3.6
• CVE-2025-25280Buffer overflow vulnerability exists in FutureNet AS series …5.3
• CVE-2025-25281An attacker may modify the URL to discover sensitive informa…7.5
• CVE-2025-25282RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…8.1
• CVE-2025-25283parse-duraton is software that allows users to convert a hum…7.5
• CVE-2025-25284The ZOO-Project is an open source processing platform, relea…8.7
• CVE-2025-25286Crayfish is a collection of Islandora 8 microservices, one o…9.8
• CVE-2025-25287Lakeus is a simple skin made for MediaWiki. Starting in vers…4.7
• CVE-2025-25288@octokit/plugin-paginate-rest is the Octokit plugin to pagin…5.3
• CVE-2025-25289@octokit/request-error is an error class for Octokit request…5.3
• CVE-2025-2529Applications using affected versions of Ehcache 3.x can expe…3.7
• CVE-2025-25290@octokit/request sends parameterized requests to GitHub’s AP…5.3