CVE-2025-25285: Octokit Endpoint ReDoS Vulnerability

CVE-2025-25285 Overview

CVE-2025-25285 is a regular expression denial-of-service (ReDoS) vulnerability in @octokit/endpoint, the npm package that converts GitHub REST API endpoints into generic request options. Versions 4.1.0 through 10.1.2 are affected. Attackers can craft specific options parameters that trigger catastrophic backtracking inside the endpoint.parse(options) call. The result is high CPU utilization and a hung process. The issue lives in the parse function within parse.ts and in the URL variable extraction helper. Version 10.1.3 contains the patch.

Critical Impact
Attacker-controlled input passed to endpoint.parse() can stall Node.js services that rely on the Octokit SDK, degrading availability for any application built on top of GitHub API tooling.

Affected Products

@octokit/endpoint versions 4.1.0 through 10.1.2
Downstream Octokit SDKs and GitHub API clients that depend on @octokit/endpoint
Node.js applications invoking endpoint.parse() with untrusted input

Discovery Timeline

2025-02-14 - CVE-2025-25285 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25285

Vulnerability Analysis

The flaw is a classic ReDoS condition classified under [CWE-1333], inefficient regular expression complexity. Two regular expressions inside @octokit/endpoint exhibit catastrophic backtracking against crafted input strings.

The first is the media type preview matcher in parse.ts, which uses /[\w-]+(?=-preview)/g against the accept header. The second is urlVariableRegex in extract-url-variable-names.ts, defined as /\{[^}]+\}/g, along with a trimming regex /^\W+|\W+$/g in removeNonChars. Each pattern can be forced into exponential matching time when the attacker supplies long inputs containing overlapping character classes.

When exploited, the Node.js event loop blocks on regex evaluation. Concurrent requests queue behind the stalled worker, producing service-wide slowdowns.

Root Cause

The regular expressions lack anchors and possessive boundaries. Without a lookbehind or atomic group, the engine explores every possible match position for [\w-]+ and [^}]+, expanding exponentially with input length. The fix constrains the patterns with negative lookbehinds and tighter character classes.

Attack Vector

An attacker supplies malicious values through any application input that eventually reaches endpoint.parse(). This includes user-controlled URL templates, accept headers, or option objects proxied into Octokit calls. No authentication is required when the vulnerable code path is exposed through a public API.

typescript

// Security patch in src/parse.ts (Source: github.com/octokit/endpoint.js commit 6c9c5be)
     if (url.endsWith("/graphql")) {
       if (options.mediaType.previews?.length) {
         const previewsFromAcceptHeader =
-          headers.accept.match(/[\w-]+(?=-preview)/g) || ([] as string[]);
+          headers.accept.match(/(?<![\w-])[\w-]+(?=-preview)/g) || ([] as string[]);
         headers.accept = previewsFromAcceptHeader
           .concat(options.mediaType.previews!)
           .map((preview) => {

typescript

// Security patch in src/util/extract-url-variable-names.ts (Source: github.com/octokit/endpoint.js commit 6c9c5be)
-const urlVariableRegex = /\{[^}]+\}/g;
+const urlVariableRegex = /\{[^{}}]+\}/g;

 function removeNonChars(variableName: string) {
-  return variableName.replace(/^\W+|\W+$/g, "").split(/,/);
+  return variableName.replace(/(?:^\W+)|(?:(?<!\W)\W+$)/g, "").split(/,/);
 }

 export function extractUrlVariableNames(url: string) {

The patched patterns add negative lookbehinds ((?<![\w-]), (?<!\W)) and a stricter character class ([^{}}]+) that eliminates ambiguous matching positions.

Detection Methods for CVE-2025-25285

Indicators of Compromise

Sustained CPU spikes on Node.js processes that import @octokit/endpoint or higher-level Octokit packages
Event loop lag warnings or unresponsive HTTP workers correlated with inbound requests carrying long accept headers or URL templates
Repeated inbound requests containing dense sequences of - or \w characters targeting endpoints that proxy Octokit calls

Detection Strategies

Inventory Node.js applications and run npm ls @octokit/endpoint to identify versions between 4.1.0 and 10.1.2
Enable Node.js --trace-warnings and monitor for blocked-event-loop signals when regex operations exceed expected duration
Review application logs for HTTP timeouts co-occurring with Octokit-driven code paths

Monitoring Recommendations

Alert on process-level CPU utilization exceeding baseline for services that call the GitHub API
Instrument request-duration histograms on routes that accept user-supplied header or URL template data
Feed application performance telemetry into a centralized data lake so single-worker stalls surface as correlated latency across a fleet

How to Mitigate CVE-2025-25285

Immediate Actions Required

Upgrade @octokit/endpoint to version 10.1.3 or later across all direct and transitive dependencies
Rebuild and redeploy any downstream Octokit SDK (@octokit/request, @octokit/core, @octokit/rest) that pins an affected version
Audit application code for any path that forwards untrusted input into endpoint.parse() or Octokit option objects

Patch Information

The fix ships in @octokit/endpoint 10.1.3. It tightens two regular expressions in src/parse.ts and src/util/extract-url-variable-names.ts. Full details are available in the GitHub Security Advisory GHSA-x4c5-c7rf-jjgv and the patch commit.

Workarounds

Validate and length-limit any user-supplied accept headers, URL templates, or option fields before passing them to Octokit
Wrap Octokit calls in a worker thread or timeout guard so a stalled regex cannot block the main event loop
Deploy a reverse-proxy rule that rejects requests with abnormally long header values or repeated -preview tokens

bash

# Upgrade @octokit/endpoint and rebuild the lockfile
npm install @octokit/endpoint@^10.1.3
npm ls @octokit/endpoint
npm audit --production