Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2025-25290 |
CWE-ID | CWE-1333 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software |
request.js Other software / Other software solutions |
Vendor | octokit |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU112202
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2025-25290
CWE-ID:
CWE-1333 - Inefficient Regular Expression Complexity
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the regular expression `/<([^>]+)>; rel="deprecation"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. A remote attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability.
Install update from vendor's website.
Vulnerable software versionsrequest.js: 1.0.0 - 9.2.0
CPE2.3https://github.com/octokit/request.js/commit/34ff07ee86fc5c20865982d77391bc910ef19c68
https://github.com/octokit/request.js/security/advisories/GHSA-rmvr-2pp2-xj38
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.