@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtrack

Description

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and “@”, an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption.

Recommendation

Update the @octokit/request-error package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 6.0.0, < 6.1.7

  >= 1.0.0, < 5.1.1**

• Patched version(s): **6.1.7

  5.1.1**

References

• GHSA-xx4v-prfh-6cgc
• CVE-2025-25289
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia - CVE-2025-59840
• webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browse - CVE-2025-30360
• Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability (GHSA-m5vv-6r4h-3vj9) - CVE-2024-35255
• tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir - CVE-2024-49364

Tags:

npm

@octokit/request-error