CLEANSTART-2026-QY24299 @octokit/endpoint turns REST API endpoints into generic request options

Multiple security vulnerabilities affect the mongosh package. @octokit/endpoint turns REST API endpoints into generic request options. See references for individual vulnerability details...

EUVD-2025-4099

Malicious code in bioql PyPI...

CVE-2025-25285

@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific options parameters, the endpoint.parseoptions call can be triggered, leading to a regular expression denial-of-service ReDoS attack. This causes the...

CVE-2025-25285

CVE-2025-25285 affects the npm package @octokit/endpoint. The vulnerability arises in endpoint.parse(options) via crafted options in versions 4.1.0 through before 10.1.3, causing a ReDoS that can hang the program and raise CPU usage. A fix is available in version 10.1.3 (patch applied) and later....

CVE-2025-25285 @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific options parameters, the endpoint.parseoptions call can be triggered, leading to a regular expression denial-of-service ReDoS attack. This causes the...

CVE-2025-25285

@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific "options" parameters, the "endpoint.parseoptions" call can be triggered, leading to a regular expression denial-of-service ReDoS attack. This causes...

CVE-2025-25285 @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific options parameters, the endpoint.parseoptions call can be triggered, leading to a regular expression denial-of-service ReDoS attack. This causes the...

@javamodules/indexer (>=1.0.4, <=1.0.5) potentially affected by CVE-2025-25285 via @octokit/endpoint (10.0.0)

@octokit/endpoint NPM version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @octokit/endpoint and may be impacted: - @javamodules/indexer =1.0.4, =1.0.5 Source cves: CVE-2025-25285 Source advisory: OSV:GHSA-X4C5-C7RF-JJGV...

@javamodules/indexer (>=1.0.4, <=1.0.5) potentially affected by CVE-2025-25285 via @octokit/endpoint (10.0.0)

@octokit/endpoint NPM version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @octokit/endpoint and may be impacted: - @javamodules/indexer =1.0.4, =1.0.5 Source cves: CVE-2025-25285 Source advisory: GHSA-X4C5-C7RF-JJGV...

@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

Summary By crafting specific options parameters, the endpoint.parseoptions call can be triggered, leading to a regular expression denial-of-service ReDoS attack. This causes the program to hang and results in high CPU utilization. Details The issue occurs in the parse function within the parse.ts...

PT-2025-7068

Name of the Vulnerable Software and Affected Versions: @octokit/endpoint versions 4.1.0 through 10.1.3 Description: The issue is a regular expression denial-of-service ReDoS attack that can be triggered by crafting specific options parameters, causing the program to hang and resulting in high CPU...

CVE-2025-25285: Inefficient Regular Expression Complexity

@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific options parameters, the endpoint.parseoptions call can be triggered, leading to a regular expression denial-of-service ReDoS attack. This causes the...