Inefficient regular expression complexity in octokit request

1) Inefficient regular expression complexity

EUVDB-ID: #VU112202

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-25290

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the regular expression `/<([^>]+)>; rel="deprecation"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. A remote attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability.

Mitigation

Install update from vendor's website.

Vulnerable software versions

request.js: 1.0.0 - 9.2.0

CPE2.3

• cpe:2.3:a:octokit:request_js:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:octokit:request_js:1.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:octokit:request_js:1.1.1:*:*:*:*:*:*:*

External links

https://github.com/octokit/request.js/commit/34ff07ee86fc5c20865982d77391bc910ef19c68
https://github.com/octokit/request.js/security/advisories/GHSA-rmvr-2pp2-xj38

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.