CVE-2025-25285

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-25285
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25285.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-25285
Aliases
Downstream
Related
Published
2025-02-14T19:31:44.827Z
Modified
2026-02-04T04:33:35.029881Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
Details

@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific options parameters, the endpoint.parse(options) call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the parse function within the parse.ts file of the npm package @octokit/endpoint. Version 10.1.3 contains a patch for the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-1333"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25285.json"
}
References

Affected packages

Git / github.com/octokit/endpoint.js

Affected ranges

Type
GIT
Repo
https://github.com/octokit/endpoint.js
Events
Introduced
a87ff65e2f45684115fa32da4d4f688a5e28668c
Fixed
d6cf1ad777b22f80b6f6ae88c03b4ed4139dd2d2

Affected versions

v10.*
v10.0.0
v10.0.1
v10.1.0
v10.1.1
v10.1.2
v4.*
v4.1.0
v4.1.1
v4.2.0
v4.2.1
v4.2.2
v5.*
v5.0.0
v5.0.1
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.1.5
v5.1.6
v5.1.7
v5.1.8
v5.2.0
v5.2.1
v5.2.2
v5.3.0
v5.3.1
v5.3.2
v5.3.3
v5.3.4
v5.3.5
v5.3.6
v5.4.0
v5.4.1
v5.5.0
v5.5.1
v5.5.2
v5.5.3
v6.*
v6.0.0
v6.0.1
v6.0.10
v6.0.11
v6.0.12
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.0.7
v6.0.8
v6.0.9
v7.*
v7.0.0
v7.0.1
v7.0.2
v7.0.3
v7.0.4
v7.0.5
v7.0.6
v8.*
v8.0.0
v8.0.1
v9.*
v9.0.0
v9.0.1
v9.0.2
v9.0.3
v9.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25285.json"