https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:17:18 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0279 certfr-2025-avi-0279 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0279 https://cve.radiocsirt.org/vuln/euvd-2026-217762 EUVD-2026-217762 https://cve.radiocsirt.org/vuln/euvd-2026-217762 https://cve.radiocsirt.org/vuln/fkie_cve-2025-25288 <p>@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack. Version 11.4.1 contains a fix for the issue.</p> <p>@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack. Version 11.4.1 contains a fix for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-25288 https://cve.radiocsirt.org/vuln/ghsa-h5c3-5r3r-rr8q <p><strong>Affected:</strong> npm: @octokit/plugin-paginate-rest</p> <p>### Summary For the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack.</p> <p>### Details The issue occurs at [line 39](https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts) of iterator.ts in the @octokit/plugin-paginate-rest repository. The relevant code is as follows: ```js url = ((normalizedResponse.headers.link || &#34;&#34;).match( /&lt;([^&gt;]+)&gt;;\s*rel=&#34;next&#34;/, ) || [])[1]; ``` The regular expression `/&lt;([^&gt;]+)&gt;;\s*rel=&#34;next&#34;/` may lead to a potential backtracking vulnerability, resulting in a ReDoS (Regular Expression Denial of Service) attack. This could cause high CPU utilization and even service slowdowns or freezes when processing specially crafted `Link` headers.</p> <p>### PoC [The gist of PoC.js](https://gist.github.com/ShiyuBanzhou/d3f2ad000be8384d2105c87c2ed7ce7d) 1. run npm i @octokit/plugin-paginate-rest 2. run &#39;node poc.js&#39; result: 3. then the program will stuck forever with high CPU usage ```js import { Octokit } from &#34;@octokit/core&#34;; import { paginateRest } from &#34;@octokit/plugin-paginate-rest&#34;;</p> <p>const MyOctokit = Octokit.plugin(paginateRest); const octokit = new MyOctokit({ auth: &#34;your-github-token&#34;, });</p> <p>// Intercept the request to inject a malicious &#39;link&#39; header for ReDoS octokit.hook.wrap(&#34;request&#34;, async (request, options) =&gt; { const maliciousLinkHeader…</p> <p><strong>Affected:</strong> npm: @octokit/plugin-paginate-rest</p> <p>### Summary For the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack.</p> <p>### Details The issue occurs at [line 39](https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts) of iterator.ts in the @octokit/plugin-paginate-rest repository. The relevant code is as follows: ```js url = ((normalizedResponse.headers.link || &#34;&#34;).match( /&lt;([^&gt;]+)&gt;;\s*rel=&#34;next&#34;/, ) || [])[1]; ``` The regular expression `/&lt;([^&gt;]+)&gt;;\s*rel=&#34;next&#34;/` may lead to a potential backtracking vulnerability, resulting in a ReDoS (Regular Expression Denial of Service) attack. This could cause high CPU utilization and even service slowdowns or freezes when processing specially crafted `Link` headers.</p> <p>### PoC [The gist of PoC.js](https://gist.github.com/ShiyuBanzhou/d3f2ad000be8384d2105c87c2ed7ce7d) 1. run npm i @octokit/plugin-paginate-rest 2. run &#39;node poc.js&#39; result: 3. then the program will stuck forever with high CPU usage ```js import { Octokit } from &#34;@octokit/core&#34;; import { paginateRest } from &#34;@octokit/plugin-paginate-rest&#34;;</p> <p>const MyOctokit = Octokit.plugin(paginateRest); const octokit = new MyOctokit({ auth: &#34;your-github-token&#34;, });</p> <p>// Intercept the request to inject a malicious &#39;link&#39; header for ReDoS octokit.hook.wrap(&#34;request&#34;, async (request, options) =&gt; { const maliciousLinkHeader…</p> https://cve.radiocsirt.org/vuln/ghsa-h5c3-5r3r-rr8q