{"cve":"CVE-2025-25290","nvd":{"published":"2025-02-14T20:15:35.593","modified":"2026-06-17T09:00:37.507","status":"Deferred","description":"@octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to versions 9.2.1 and 8.4.1, the regular expression `/<([^>]+)>; rel=\"deprecation\"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. An attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability. Versions 9.2.1 and 8.4.1 fix the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3},"cwes":["CWE-1333"],"references":["https://github.com/octokit/request.js/commit/34ff07ee86fc5c20865982d77391bc910ef19c68","https://github.com/octokit/request.js/commit/356411e3217019aa9fc8a68f4236af82490873c2","https://github.com/octokit/request.js/commit/6bb29ba92a52f7bf94469c3433707c682c17126c","https://github.com/octokit/request.js/releases/tag/v8.4.1","https://github.com/octokit/request.js/releases/tag/v9.2.1"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:59:18.731010617+00:00"},"epss":{"cve":"CVE-2025-25290","score":0.00783,"percentile":0.56031,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-rmvr-2pp2-xj38","url":"https://osv.dev/vulnerability/GHSA-rmvr-2pp2-xj38","summary":"@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking","modified":"2026-09-10T03:50:06.180315372Z","packages":[{"ecosystem":"npm","name":"@octokit/request","purl":"pkg:npm/%40octokit/request","ranges":[">=9.0.0-beta.1 <9.2.1"],"fixed":["9.2.1"]},{"ecosystem":"npm","name":"@octokit/request","purl":"pkg:npm/%40octokit/request","ranges":[">=1.0.0 <8.4.1"],"fixed":["8.4.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}