CVE-2025-25289: Octokit Request Error ReDoS Vulnerability

CVE-2025-25289 Overview

CVE-2025-25289 is a Regular Expression Denial of Service (ReDoS) vulnerability in @octokit/request-error, the error class library used by Octokit clients to represent GitHub API request failures. The flaw affects versions 1.0.0 through 6.1.6 and is fixed in 6.1.7. When the library redacts the authorization header for error logging, an inefficient regular expression can be forced into pathological backtracking by supplying a header value containing a long run of spaces followed by a newline and @. Exploitation degrades server performance and can produce a denial-of-service condition affecting availability [CWE-1333].

Critical Impact
A remote attacker can trigger excessive CPU consumption in any Node.js service that passes attacker-influenced authorization headers through @octokit/request-error, impacting availability without requiring authentication or user interaction.

Affected Products

@octokit/request-error versions 1.0.0 through 6.1.6
Node.js applications and services embedding Octokit clients that surface request errors
GitHub integrations and automation tooling built on the Octokit SDK

Discovery Timeline

2025-02-14 - CVE-2025-25289 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25289

Vulnerability Analysis

The vulnerability lives in the error-construction path of @octokit/request-error. When the library builds a sanitized copy of the failing request, it redacts the credential portion of the authorization header by running a regular expression replace against the header value. The original expression, .*$, matches a single space followed by the remainder of the string. Node.js applications commonly propagate client-supplied authorization headers into Octokit calls, so attacker-controlled input can reach this regex without prior sanitization. The impact is confined to availability, with no confidentiality or integrity consequences, but a single request can consume significant CPU on the event loop and stall other handlers.

Root Cause

The fix in commit d558320 changes the pattern from .*$ to (?<! ) .*$, adding a negative lookbehind so the match only anchors on the first space that is not preceded by another space. Without this anchor, engine behavior on inputs containing long space runs followed by \n@ forces catastrophic backtracking as the regex explores overlapping match positions. The underlying weakness is inefficient regular expression complexity [CWE-1333] applied to unsanitized header input.

Attack Vector

An unauthenticated remote attacker sends an HTTP request with an Authorization header containing an excessively long sequence of spaces followed by \n@. When the downstream Octokit call fails and @octokit/request-error constructs the error object, the redaction regex evaluates against the malicious value and blocks the Node.js event loop. Repeated requests amplify the effect into a sustained denial-of-service condition.

typescript

// Patch from src/index.ts
     if (options.request.headers.authorization) {
       requestCopy.headers = Object.assign({}, options.request.headers, {
         authorization: options.request.headers.authorization.replace(
-          / .*$/,
+          /(?<! ) .*$/,
           " [REDACTED]",
         ),
       });

Source: GitHub commit d558320

Detection Methods for CVE-2025-25289

Indicators of Compromise

HTTP requests containing Authorization headers with unusually long runs of whitespace followed by \n@ or similar control characters.
Node.js worker processes exhibiting sustained single-core CPU saturation correlated with inbound API traffic.
Elevated request latency or event loop lag metrics on services that wrap the Octokit SDK.

Detection Strategies

Inspect ingress logs and WAF telemetry for oversized Authorization header values, especially those exceeding a few hundred bytes or containing embedded newlines.
Enumerate installed dependencies with npm ls @octokit/request-error and flag any version below 6.1.7 across build pipelines and container images.
Correlate spikes in Node.js CPU time with error-handler code paths that instantiate RequestError objects.

Monitoring Recommendations

Alert on event loop delay metrics (for example perf_hookseventLoopUtilization) exceeding baseline during API traffic bursts.
Track dependency inventory continuously through Software Composition Analysis to detect reintroduction of vulnerable Octokit versions.
Log and sample truncated header values at reverse proxies to identify malformed authorization patterns before they reach application code.

How to Mitigate CVE-2025-25289

Immediate Actions Required

Upgrade @octokit/request-error to version 6.1.7 or later in all Node.js projects and transitive dependency trees.
Rebuild and redeploy container images, serverless bundles, and CI artifacts that pin older Octokit releases.
Add ingress-layer validation to reject Authorization headers containing newline characters or excessive whitespace.

Patch Information

The maintainers released the fix in version 6.1.7 via commit d558320874a4bc8d356babf1079e6f0056a59b9e. Details are published in the GitHub Security Advisory GHSA-xx4v-prfh-6cgc. Downstream Octokit packages that depend on @octokit/request-error should be updated so the fixed version resolves at install time.

Workarounds

Enforce a strict maximum length on the Authorization header at the reverse proxy or API gateway.
Strip or reject header values containing embedded \n, \r, or non-printable characters before they reach Node.js handlers.
Wrap Octokit invocations in a timeout so a stalled redaction operation cannot indefinitely block a worker.

bash

# Upgrade the vulnerable package
npm install @octokit/request-error@^6.1.7

# Verify no vulnerable versions remain in the dependency tree
npm ls @octokit/request-error

# Audit for known advisories
npm audit --production