StackRadarChart IndexLive demo

CVE-2025-25288

Medium

Advisory

Published 14 Feb 2025In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.006; 48th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 19; of 17,781 indexed, latest versions
Container images: 17; deployed by those charts
Fix available: 1 of 1; affected package

@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

Carried by container images the latest versions of 19 of 17,781 indexed charts deploy, on 17 images.

Affected package	Affected versions	Fixed in	Images
@octokit/plugin-paginate-restnpm	1.1.2, 2.0.2, 2.2.3, 2.7.0+9 more	9.2.2, 11.4.1	17

OSV records: GHSA-h5c3-5r3r-rr8q

Charts affected

19 by stars

Chart

Latest

Affected images

Radar Score

backstagebackstage

1 of 1 See more

backstage backstage 2.10.1

1 of the 1 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
ghcr.io/backstage/backstage :latest	792e262ea504	@octokit/plugin-paginate-rest@6.1.2	9.2.2

Open the chart page →

1,195

outlinekubitodev

1 of 4 See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
outlinewiki/outline :0.82.0	494dfb9249a6	@octokit/plugin-paginate-rest@11.3.1	11.4.1

Open the chart page →

5,352

sorry-cypresssorry-cypress

1 of 4 See more

sorry-cypress sorry-cypress 1.20.0

1 of the 4 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
agoldis/sorry-cypress-director :2.5.11	10228ecd353b	@octokit/plugin-paginate-rest@5.0.1	9.2.2

Open the chart page →

4,285

backstagerhdh-chart

1 of 2 See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
quay.io/rhdh/rhdh-hub-rhel9 :latest	0b26358f5793	@octokit/plugin-paginate-rest@6.1.2	9.2.2

Open the chart page →

1,339

backstagedeliveryhero

1 of 2 See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
martinaif/backstage-k8s-demo-backend :test1	43bc40a3da0e	@octokit/plugin-paginate-rest@1.1.2	9.2.2

Open the chart page →

8,213

zwavejs2mqttgeek-cookbook

1 of 1 See more

zwavejs2mqtt geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
zwavejs/zwavejs2mqtt :5.0.2	15a6040fb468	@octokit/plugin-paginate-rest@2.13.3	9.2.2

Open the chart page →

3,476

bredbandskollen-prometheus-exporteraolde

1 of 1 See more

bredbandskollen-prometheus-exporter aolde 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
aolde/bredbandskollen-prometheus-exporter :1.0.2	dc61ee713720	@octokit/plugin-paginate-rest@2.13.3	9.2.2

Open the chart page →

1,972

lametric-nightscout-proxyaolde

1 of 1 See more

lametric-nightscout-proxy aolde 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
ghcr.io/aolde/lametric-nightscout-proxy :latest	7d1951b6baf5	@octokit/plugin-paginate-rest@4.3.1	9.2.2

Open the chart page →

1,186

developer-dashboardcloud-native-toolkit

1 of 1 See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
quay.io/ibmgaragecloud/developer-dashboard :v1.4.4	7a4b9fedc724	@octokit/plugin-paginate-rest@2.0.2	9.2.2

Open the chart page →

25,456

mergeabledouban

1 of 1 See more

mergeable douban 0.2.2

1 of the 1 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
ghcr.io/leoquote/mergeable :latest	451706815103	@octokit/plugin-paginate-rest@1.1.2	9.2.2

Open the chart page →

4,223

backstagehelm-charts-nr

1 of 2 See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
martinaif/backstage-k8s-demo-backend :test1	43bc40a3da0e	@octokit/plugin-paginate-rest@1.1.2	9.2.2

Open the chart page →

8,213

dtlinfradao

1 of 1 See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
ethereumoptimism/data-transport-layer :0.5.56	e07968a0e686	@octokit/plugin-paginate-rest@2.15.1	9.2.2

Open the chart page →

4,944

backstageirembo-backstage-helm

1 of 3 See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
roadiehq/community-backstage-image :latest	ef355bf5b639	@octokit/plugin-paginate-rest@2.7.0	9.2.2

Open the chart page →

7,232

kubevismario-f

1 of 1 See more

kubevis mario-f 2.0.1

1 of the 1 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
ghcr.io/mario-f/kubevis :v1.4.0	763daf9caf8e	@octokit/plugin-paginate-rest@2.14.0	9.2.2

Open the chart page →

5,287

backstagemcwarman

1 of 2 See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
ghcr.io/mcwarman/backstage-sample-app/backend :main	07aba09a594f	@octokit/plugin-paginate-rest@9.2.1	9.2.2

Open the chart page →

9,668

sentence-collectormozilla

1 of 2 See more

sentence-collector mozilla 0.1.2

1 of the 2 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
mozilla/sentencecollector :2.0.9	1da6ff5c4895	@octokit/plugin-paginate-rest@2.2.3	9.2.2

Open the chart page →

6,684

tianjimsgbyte

1 of 2 See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
moonrailgun/tianji :1.11.2	b528c8f8fcc4	@octokit/plugin-paginate-rest@9.1.5	9.2.2

Open the chart page →

4,560

sorry-cypresssoftonic

1 of 4 See more

sorry-cypress softonic 1.20.0

1 of the 4 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
agoldis/sorry-cypress-director :2.5.11	10228ecd353b	@octokit/plugin-paginate-rest@5.0.1	9.2.2

Open the chart page →

4,285

devportalveecode-platform-next

1 of 1 See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry CVE-2025-25288.

Container image	Digest	Package	Fixed in
veecode/devportaldigest-pinned	c443520aebf7	@octokit/plugin-paginate-rest@6.1.2	9.2.2

Open the chart page →

1,787

Container images carrying it

17 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
agoldis/sorry-cypress-director :2.5.11	10228ecd353b	@octokit/plugin-paginate-rest@5.0.1	9.2.2	2
martinaif/backstage-k8s-demo-backend :test1	43bc40a3da0e	@octokit/plugin-paginate-rest@1.1.2	9.2.2	2
aolde/bredbandskollen-prometheus-exporter :1.0.2	dc61ee713720	@octokit/plugin-paginate-rest@2.13.3	9.2.2	1
ethereumoptimism/data-transport-layer :0.5.56	e07968a0e686	@octokit/plugin-paginate-rest@2.15.1	9.2.2	1
moonrailgun/tianji :1.11.2	b528c8f8fcc4	@octokit/plugin-paginate-rest@9.1.5	9.2.2	1
mozilla/sentencecollector :2.0.9	1da6ff5c4895	@octokit/plugin-paginate-rest@2.2.3	9.2.2	1
outlinewiki/outline :0.82.0	494dfb9249a6	@octokit/plugin-paginate-rest@11.3.1	11.4.1	1
roadiehq/community-backstage-image :latest	ef355bf5b639	@octokit/plugin-paginate-rest@2.7.0	9.2.2	1
veecode/devportal	c443520aebf7	@octokit/plugin-paginate-rest@6.1.2	9.2.2	1
zwavejs/zwavejs2mqtt :5.0.2	15a6040fb468	@octokit/plugin-paginate-rest@2.13.3	9.2.2	1
ghcr.io/aolde/lametric-nightscout-proxy :latest	7d1951b6baf5	@octokit/plugin-paginate-rest@4.3.1	9.2.2	1
ghcr.io/backstage/backstage :latest	792e262ea504	@octokit/plugin-paginate-rest@6.1.2	9.2.2	1
ghcr.io/leoquote/mergeable :latest	451706815103	@octokit/plugin-paginate-rest@1.1.2	9.2.2	1
ghcr.io/mario-f/kubevis :v1.4.0	763daf9caf8e	@octokit/plugin-paginate-rest@2.14.0	9.2.2	1
ghcr.io/mcwarman/backstage-sample-app/backend :main	07aba09a594f	@octokit/plugin-paginate-rest@9.2.1	9.2.2	1
quay.io/ibmgaragecloud/developer-dashboard :v1.4.4	7a4b9fedc724	@octokit/plugin-paginate-rest@2.0.2	9.2.2	1
quay.io/rhdh/rhdh-hub-rhel9 :latest	0b26358f5793	@octokit/plugin-paginate-rest@6.1.2	9.2.2	1