CVE-2025-25290: @octokit/request ReDoS DOS Vulnerability

CVE-2025-25290 Overview

CVE-2025-25290 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting the @octokit/request JavaScript library, which sends parameterized requests to GitHub's APIs from browsers and Node.js environments. The flaw resides in the regular expression /<([^>]+)>; rel="deprecation"/ used to parse the link HTTP response header. Attackers who can influence the link header in HTTP responses can trigger catastrophic backtracking, causing excessive CPU consumption. The vulnerability affects versions from 1.0.0 up to but not including 9.2.1 and 8.4.1. It is categorized under [CWE-1333] (Inefficient Regular Expression Complexity).

Critical Impact
Successful exploitation results in CPU exhaustion and service unresponsiveness, degrading availability of Node.js applications and browser-based tools that consume the @octokit/request library.

Affected Products

@octokit/request versions 1.0.0 through 8.4.0
@octokit/request versions 9.0.0 through 9.2.0
Downstream Octokit packages that depend on vulnerable versions of @octokit/request

Discovery Timeline

2025-02-14 - CVE-2025-25290 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25290

Vulnerability Analysis

The vulnerability exists in the fetch-wrapper module of @octokit/request. When a response includes a deprecation header, the library attempts to extract the deprecation notice URL from the link header using the regex /<([^>]+)>; rel="deprecation"/. The character class [^>]+ greedily consumes any character other than >, including additional < symbols. When the input lacks a proper terminating >; rel="deprecation" sequence, the regex engine backtracks across every possible split of the captured content, producing quadratic or worse execution time relative to input length.

Root Cause

The root cause is an insufficiently constrained character class in the deprecation-parsing regular expression. The pattern [^>]+ does not exclude the < character, allowing nested angle bracket sequences to trigger catastrophic backtracking. This is a classic [CWE-1333] Inefficient Regular Expression Complexity issue.

Attack Vector

An attacker who can control or inject content into an HTTP response link header returned to a client using @octokit/request can send a crafted payload composed of many < characters without a matching >; rel="deprecation" termination. Processing that header on the client blocks the Node.js event loop or the browser main thread, resulting in denial of service. This is exploitable in scenarios such as compromised proxies, malicious mirror hosts, or environments where the caller directs requests to attacker-controlled endpoints.

typescript

// Security patch in src/fetch-wrapper.ts
// Source: https://github.com/octokit/request.js/commit/356411e3217019aa9fc8a68f4236af82490873c2

      if ("deprecation" in headers) {
        const matches =
-         headers.link && headers.link.match(/<([^>]+)>; rel="deprecation"/);
+         headers.link && headers.link.match(/<([^<>]+)>; rel="deprecation"/);
        const deprecationLink = matches && matches.pop();
        log.warn(
          `[@octokit/request] "${requestOptions.method} ${

The fix tightens the character class from [^>]+ to [^<>]+, preventing the regex engine from backtracking across nested < characters and eliminating the catastrophic backtracking condition.

Detection Methods for CVE-2025-25290

Indicators of Compromise

Sustained 100% CPU utilization in Node.js processes that consume GitHub API responses through @octokit/request or dependent Octokit packages.
Application unresponsiveness or event loop stalls correlated with outbound requests to GitHub or GitHub-like endpoints.
HTTP responses containing link headers with anomalous sequences of < characters and no valid rel="deprecation" termination.

Detection Strategies

Inventory package.json and package-lock.json files across repositories and build artifacts for @octokit/request versions below 9.2.1 or 8.4.1.
Run npm audit or yarn audit to identify advisories referencing GHSA-rmvr-2pp2-xj38.
Instrument HTTP client middleware to log link header length and character distribution, flagging headers with disproportionate < counts.

Monitoring Recommendations

Alert on Node.js process CPU spikes lasting longer than expected request-handling windows.
Monitor event loop lag metrics using tools such as perf_hooks or APM agents to detect blocking regex evaluations.
Track dependency inventory continuously through Software Composition Analysis (SCA) tooling and correlate against GHSA-rmvr-2pp2-xj38.

How to Mitigate CVE-2025-25290

Immediate Actions Required

Upgrade @octokit/request to version 9.2.1 or 8.4.1, depending on the major version in use.
Update transitive dependencies by refreshing lock files and rebuilding container images that bundle affected versions.
Restrict outbound HTTP requests from services using @octokit/request to trusted GitHub endpoints only.

Patch Information

The maintainers released fixed builds as v9.2.1 and v8.4.1. The remediation replaces the vulnerable regex in src/fetch-wrapper.ts as shown in commits 34ff07e and 356411e. Details are documented in GHSA-rmvr-2pp2-xj38.

Workarounds

Route @octokit/request traffic through a trusted egress proxy that strips or validates the response link header.
Wrap calls to @octokit/request in a worker thread or execution timeout to bound the impact of a stalled regex evaluation.
Pin dependencies to patched versions in package.json and enforce SCA policy gates in CI pipelines to block reintroduction of vulnerable versions.

bash

# Upgrade to patched versions
npm install @octokit/request@^9.2.1
# or, for the 8.x line
npm install @octokit/request@^8.4.1

# Verify installed version
npm ls @octokit/request

# Audit for the advisory
npm audit --production