{"action":"Upgrade @octokit/request to 8.4.1 or later.","affected":[{"fixed":"9.2.1","introduced":"9.0.0-beta.1"},{"fixed":"8.4.1","introduced":"1.0.0"}],"component":"@octokit/request","cve_ids":["CVE-2025-25290"],"ecosystem":"npm","epss":0.00783,"exploited":false,"fixed_versions":["9.2.1","8.4.1"],"ghsa_id":"GHSA-rmvr-2pp2-xj38","id":"tcs_01M5KG9EM10RERAP31RC2NS9EE","modified_at":"2026-09-10T03:50:06.180315372Z","published_at":"2025-02-14T18:00:18Z","references":["https://osv.dev/vulnerability/GHSA-rmvr-2pp2-xj38","https://github.com/octokit/request.js/security/advisories/GHSA-rmvr-2pp2-xj38","https://nvd.nist.gov/vuln/detail/CVE-2025-25290","https://github.com/octokit/request.js/commit/34ff07ee86fc5c20865982d77391bc910ef19c68","https://github.com/octokit/request.js/commit/356411e3217019aa9fc8a68f4236af82490873c2","https://github.com/octokit/request.js/commit/6bb29ba92a52f7bf94469c3433707c682c17126c","https://github.com/octokit/request.js","https://github.com/octokit/request.js/releases/tag/v8.4.1","https://github.com/octokit/request.js/releases/tag/v9.2.1"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-rmvr-2pp2-xj38","url":"https://osv.dev/vulnerability/GHSA-rmvr-2pp2-xj38"}],"summary":"@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking"}