CVE-2025-25290

@octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to versions 9.2.1 and 8.4.1, the regular expression `/<([^>]+)>; rel="deprecation"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. An attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability. Versions 9.2.1 and 8.4.1 fix the issue.

• CWE-1333

• https://github.com/octokit/request.js/commit/34ff07ee86fc5c20865982d77391bc910ef19c68
• https://github.com/octokit/request.js/commit/356411e3217019aa9fc8a68f4236af82490873c2
• https://github.com/octokit/request.js/commit/6bb29ba92a52f7bf94469c3433707c682c17126c
• https://github.com/octokit/request.js/releases/tag/v8.4.1
• https://github.com/octokit/request.js/releases/tag/v9.2.1
• https://github.com/octokit/request.js/security/advisories/GHSA-rmvr-2pp2-xj38

Published

Feb 14, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25285@octokit/endpoint turns REST API endpoints into generic requ…5.3
• CVE-2025-25286Crayfish is a collection of Islandora 8 microservices, one o…9.8
• CVE-2025-25287Lakeus is a simple skin made for MediaWiki. Starting in vers…4.7
• CVE-2025-25288@octokit/plugin-paginate-rest is the Octokit plugin to pagin…5.3
• CVE-2025-25289@octokit/request-error is an error class for Octokit request…5.3
• CVE-2025-2529Applications using affected versions of Ehcache 3.x can expe…3.7
• CVE-2025-25291ruby-saml provides security assertion markup language (SAML)…9.8
• CVE-2025-25292ruby-saml provides security assertion markup language (SAML)…9.8
• CVE-2025-25293ruby-saml provides security assertion markup language (SAML)…7.5
• CVE-2025-25294Envoy Gateway is an open source project for managing Envoy P…5.3
• CVE-2025-25295Label Studio is an open source data labeling tool. A path tr…8.7
• CVE-2025-25296Label Studio is an open source data labeling tool. Prior to …6.1