CVE-2025-25288 (Medium) detected in plugin-paginate-rest-9.2.2.tgz

[mend-bolt-for-github]

CVE-2025-25288 - Medium Severity Vulnerability

Vulnerable Library - plugin-paginate-rest-9.2.2.tgz

Octokit plugin to paginate REST API endpoint responses

Library home page: https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• github-6.0.0.tgz (Root Library)
  • ❌ plugin-paginate-rest-9.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 8dbdb4a1170502df116e35d16ab172d26c02609e

Found in base branch: main

Vulnerability Details

@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm package "@octokit/plugin-paginate-rest", when calling "octokit.paginate.iterator()", a specially crafted "octokit" instance—particularly with a malicious "link" parameter in the "headers" section of the "request"—can trigger a ReDoS attack. Version 11.4.1 contains a fix for the issue.

Publish Date: 2025-02-14

URL: CVE-2025-25288

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h5c3-5r3r-rr8q

Release Date: 2025-02-14

Fix Resolution: @octokit/plugin-paginate-rest - 11.4.1

---

Step up your Open Source Security Game with Mend here