Unauthenticated Denial of Service in the octokit/webhooks library
Impact
Versions v9.26.0, v10.9.x), v11.1.x, v12.0.x all contained the code that would throw the error.
Specifically, during a pentest we encountered a bug in the octokit/webhooks library (a dependency of Probot, a framework for building Github Apps). The resulting request was found to cause an uncaught exception that ends the nodejs process.
The problem is caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases.
Credit goes to @pb82 (for the early analysis) and @rh-tguittet (for discovery).
Patches
Maintenance releases for the Error being thrown by the verify method in octokit/webhooks.js
Maintenance release for the reference for octokit/webhooks.js in app.js
Maintenance release for the reference for octokit/webhooks.js in octokit.js
Maintenance release for the reference for octokit/webhooks.js in Protobot
Workarounds
It is recommend that all users upgrade to the latest version of octokit/webhooks.js or use one of the updated back ported versions.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | octokit | < 3.1.2 | 3.1.2 |
| npm package | @octokit/app | >= 14.0.1, < 14.0.2 | 14.0.2 |
| npm package | @octokit/webhooks | < 9.26.3, >= 10.0.0, < 10.9.2, >= 11.0.0, < 11.1.2, >= 12.0.0, < 12.0.3 | 9.26.3, 10.9.2, 11.1.2, 12.0.3 |
| npm package | probot | < 12.3.3 | 12.3.3 |
References
- https://github.com/octokit/webhooks.js/security/advisories/GHSA-pwfr-8pq7-x9qv
- https://nvd.nist.gov/vuln/detail/CVE-2023-50728
- https://github.com/octokit/app.js/releases/tag/v14.0.2
- https://github.com/octokit/octokit.js/releases/tag/v3.1.2
- https://github.com/octokit/webhooks.js
- https://github.com/octokit/webhooks.js/releases/tag/v10.9.2
- https://github.com/octokit/webhooks.js/releases/tag/v11.1.2
- https://github.com/octokit/webhooks.js/releases/tag/v12.0.4
- https://github.com/octokit/webhooks.js/releases/tag/v9.26.3
- https://github.com/probot/probot/releases/tag/v12.3.3
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H- Weakness (CWE)
CWE-755- Platform
- npm
- Package
octokit, @octokit/app, @octokit/webhooks- Disclosed
- 16.12.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-pwfr-8pq7-x9qv - CC BY 4.0
Vulnerability history: octokit
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.