Homepage

Inefficient Regular Expression Complexity The advisory has been revoked - it doesn't affect any version of package rhdh/rhdh-hub-rhel9.src  (opens in a new tab)

Threat Intelligence

EPSS
0.08% (24th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-RHDHRHDHHUBRHEL9SRC-15029762
  • published17 Jan 2026
  • disclosed14 Feb 2025
Report a new vulnerability Found a mistake?

Introduced: 14 Feb 2025

CVE-2025-25290  (opens in a new tab)
CWE-1333  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rhdh/rhdh-hub-rhel9.src package and not the rhdh/rhdh-hub-rhel9.src package as distributed by RHEL.

@octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to versions 9.2.1 and 8.4.1, the regular expression /<([^>]+)>; rel="deprecation"/ used to match the link header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. An attacker could exploit this flaw by sending a malicious link header, resulting in excessive CPU usage and potentially causing the server to become unresponsive, impacting service availability. Versions 9.2.1 and 8.4.1 fix the issue.