PT-2025-7072 · Npm · @Octokit/Request-Error

Shiyubanzhou

·

Published

2025-02-14

·

Updated

2026-01-23

·

CVE-2025-25289

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Name of the Vulnerable Software and Affected Versions: @octokit/request-error versions 1.0.0 through 6.1.6
Description: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and "@", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability.
Recommendations: For @octokit/request-error versions 1.0.0 through 6.1.6, update to version 6.1.7 to resolve the issue. As a temporary workaround, consider restricting the length of the authorization header to prevent excessive resource consumption. Avoid using the authorization header with long sequences of spaces followed by a newline and "@" until the issue is resolved.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2025-25289
GHSA-XX4V-PRFH-6CGC

Affected Products

@Octokit/Request-Error