fix(deps): update dependency @octokit/request-error to v5 [security]

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
@octokit/request-error	^2.1.0 -> ^5.0.0

GitHub Vulnerability Alerts

CVE-2025-25289

Summary

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and "@​", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability.

Details

The issue occurs at line 52 of iterator.ts in the @​octokit/request-error repository.
The vulnerability is caused by the use of an inefficient regular expression in the handling of the authorization header within the request processing logic:

authorization: options.request.headers.authorization.replace(
  / .*$/, 
  " [REDACTED]"
)

The regular expression / .*$/ matches a space followed by any number of characters until the end of the line. This pattern is vulnerable to Regular Expression Denial of Service (ReDoS) when processing specially crafted input. Specifically, an attacker can send an authorization header containing a long sequence of spaces followed by a newline and "@​", such as:

headers: {
  authorization: "" + " ".repeat(100000) + "\n@",
}

Due to the way JavaScript's regular expression engine backtracks while attempting to match the space followed by arbitrary characters, this input can cause excessive CPU usage, significantly slowing down or even freezing the server. This leads to a denial-of-service condition, impacting availability.

PoC

The gist of PoC.js

1. run npm i @​octokit/request-error
2. run 'node poc.js'
   result:
3. then the program will stuck forever with high CPU usage

import { RequestError } from "@​octokit/request-error";

const error = new RequestError("Oops", 500, {
  request: {
    method: "POST",
    url: "https://api.github.com/foo",
    body: {
      bar: "baz",
    },
    headers: {
      authorization: ""+" ".repeat(100000)+"\n@",
    },
  },
  response: {
    status: 500,
    url: "https://api.github.com/foo",
    headers: {
      "x-github-request-id": "1:2:3:4",
    },
    data: {
      foo: "bar",
    },
  },
});

Impact

Vulnerability Type & Impact:

This is a Regular Expression Denial of Service (ReDoS) vulnerability, which occurs due to an inefficient regular expression (/ .*$/) used to sanitize the authorization header. An attacker can craft a malicious input that triggers excessive backtracking in the regex engine, leading to high CPU consumption and potential denial-of-service (DoS).

Who is Impacted?

• Projects or services using this code to process HTTP headers are vulnerable.
• Applications that rely on user-supplied authorization headers are at risk, especially those processing a large volume of authentication requests.
• Multi-tenant or API-driven platforms could experience degraded performance or service outages if exploited at scale.

---

@​octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

CVE-2025-25289 / GHSA-xx4v-prfh-6cgc

More information

Details

Summary

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and "@​", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability.

Details

The issue occurs at line 52 of iterator.ts in the @​octokit/request-error repository.
The vulnerability is caused by the use of an inefficient regular expression in the handling of the authorization header within the request processing logic:

authorization: options.request.headers.authorization.replace(
  / .*$/, 
  " [REDACTED]"
)

The regular expression / .*$/ matches a space followed by any number of characters until the end of the line. This pattern is vulnerable to Regular Expression Denial of Service (ReDoS) when processing specially crafted input. Specifically, an attacker can send an authorization header containing a long sequence of spaces followed by a newline and "@​", such as:

headers: {
  authorization: "" + " ".repeat(100000) + "\n@",
}

Due to the way JavaScript's regular expression engine backtracks while attempting to match the space followed by arbitrary characters, this input can cause excessive CPU usage, significantly slowing down or even freezing the server. This leads to a denial-of-service condition, impacting availability.

PoC

The gist of PoC.js

1. run npm i @​octokit/request-error
2. run 'node poc.js'
   result:
3. then the program will stuck forever with high CPU usage

import { RequestError } from "@​octokit/request-error";

const error = new RequestError("Oops", 500, {
  request: {
    method: "POST",
    url: "https://api.github.com/foo",
    body: {
      bar: "baz",
    },
    headers: {
      authorization: ""+" ".repeat(100000)+"\n@",
    },
  },
  response: {
    status: 500,
    url: "https://api.github.com/foo",
    headers: {
      "x-github-request-id": "1:2:3:4",
    },
    data: {
      foo: "bar",
    },
  },
});

Impact

Vulnerability Type & Impact:

This is a Regular Expression Denial of Service (ReDoS) vulnerability, which occurs due to an inefficient regular expression (/ .*$/) used to sanitize the authorization header. An attacker can craft a malicious input that triggers excessive backtracking in the regex engine, leading to high CPU consumption and potential denial-of-service (DoS).

Who is Impacted?

• Projects or services using this code to process HTTP headers are vulnerable.
• Applications that rely on user-supplied authorization headers are at risk, especially those processing a large volume of authentication requests.
• Multi-tenant or API-driven platforms could experience degraded performance or service outages if exploited at scale.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/octokit/request-error.js/security/advisories/GHSA-xx4v-prfh-6cgc
• https://nvd.nist.gov/vuln/detail/CVE-2025-25289
• https://github.com/octokit/request-error.js/commit/d558320874a4bc8d356babf1079e6f0056a59b9e
• https://github.com/octokit/request-error.js
• https://github.com/octokit/request-error.js/blob/main/src/index.ts

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

octokit/request-error.js (@​octokit/request-error)

v5.1.1

Compare Source

Bug Fixes

• ReDos regex vulnerability, reported by @​dayshift (12a14f0)

v5.1.0

Compare Source

Bug Fixes

• upgrade @octokit/types to v13 (3af20bd)

Features

• security: Add provenance (#​416) (94147e8)

v5.0.1

Compare Source

Bug Fixes

• deps: update dependency @​octokit/types to v12 (#​366) (590fc39)

v5.0.0

Compare Source

Bug Fixes

• deps: update dependency @​octokit/types to v11 (#​348) (372097e)

BREAKING CHANGES

• deps: upgrade @octokit/types to v11

v4.0.2

Compare Source

Bug Fixes

• deps: update dependency @​octokit/types to v10 (#​343) (28b1958)

v4.0.1

Compare Source

Bug Fixes

• build: switch to esbuild (#​338) (5ff96da)

v4.0.0

Compare Source

Continuous Integration

• stop testing against NodeJS v14, v16 (#​331) (dc68be2)

BREAKING CHANGES

• Drop support for NodeJS v14, v16

• ci: stop testing against NodeJS v14, v16

• ci: stop testing against NodeJS v14, v16

• ci: stop testing against NodeJS v14, v16

• ci: stop testing against NodeJS v14, v16

• ci: stop testing against NodeJS v14, v16

v3.0.3

Compare Source

Bug Fixes

• deps: update dependency @​octokit/types to v9 (#​307) (82c78fc)

v3.0.2

Compare Source

Bug Fixes

• deps: update dependency @​octokit/types to v8 (4cabbec)

v3.0.1

Compare Source

Bug Fixes

• deps: update dependency @​octokit/types to v7 (#​254) (5abe81a)

v3.0.0

Compare Source

Continuous Integration

• stop testing against NodeJS v10, v12 (#​236) (0a86afe)

BREAKING CHANGES

• Drop support for NodeJS v10, v12

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.