CVE-2025-25289

Summary

CVE-2025-25289 is a vulnerability affecting the error handling in the '@octokit/request-error' library used by Octokit. Prior to version 6.1.7, this library was susceptible to a Regular Expression Denial of Service (ReDoS) attack. Malicious actors could exploit inefficient regular expression processing by sending an authorization header containing an excessively long sequence of spaces, followed by a newline and "@". This would result in excessive resource consumption, leading to a significant degradation of server performance or even a denial-of-service (DoS) condition. The vulnerability has been addressed in version 6.1.7, with a patch now available to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.