CVE-2025-25285 @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
Attackers can cause high CPU utilization and application hangs in the @octokit/endpoint library by triggering a ReDoS vulnerability via crafted parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-25285?
CVE-2025-25285 is a medium-severity denial of service vulnerability in octokit endpoint.js, published on 14 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the `parse` function within the `parse.ts` file of the npm package `@octokit/endpoint`. Version 10.1.3 contains a patch for the issue.
Weakness: CWE-1333
Which versions are affected by CVE-2025-25285?
4 open source packages ship an affected version, including @octokit/endpoint.
| Package | Affected | Fixed in |
|---|---|---|
@octokit/endpoint npm | From 10.0.0 | 10.1.3 |
@octokit/endpoint npm | From 10.0.0 | 10.1.3 |
@octokit/endpoint npm | From 9.0.5 | 9.0.6 |
@octokit/endpoint npm | From 9.0.5 | 9.0.6 |
How do I fix CVE-2025-25285?
Upgrade @octokit/endpoint to a fixed version for your release line: 10.1.3 or 9.0.6.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-25285 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25285 exists.
Sources
Also known as CLEANSTART-2026-XE96590, GHSA-x4c5-c7rf-jjgv.