#VU112202 Inefficient regular expression complexity in request.js - CVE-2025-25290

Vulnerability identifier: #VU112202

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-25290

CWE-ID: CWE-1333

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
request.js
Other software / Other software solutions

Vendor: octokit

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the regular expression `/<([^>]+)>; rel="deprecation"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. A remote attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

Vulnerable software versions

request.js: 1.0.0 - 9.2.0

---

External links
https://github.com/octokit/request.js/commit/34ff07ee86fc5c20865982d77391bc910ef19c68
https://github.com/octokit/request.js/security/advisories/GHSA-rmvr-2pp2-xj38

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.