CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCVE-2025-25285
Medium (5.3). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in @octokit/endpoint 10.1.3, 9.0.6.
@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the `parse` function within the `parse.ts` file of the npm package `@octokit/endpoint`. Version 10.1.3 contains a patch for the issue.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
- CWE
- CWE-1333
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-x4c5-c7rf-jjgv | npm | @octokit/endpoint | >=9.0.5 <9.0.6 | 9.0.6 |
| GHSA-x4c5-c7rf-jjgv | npm | @octokit/endpoint | >=10.0.0 <10.1.3 | 10.1.3 |