CVE-2023-50728
Unauthenticated Denial of Service in the octokit/webhooks library
Reported by github_m · Published December 15, 2023
octokit is fixed in 3.1.2 (npm)
octokit/webhooks is a GitHub webhook events toolset for Node.js. Starting in 9.26.0 and prior to 9.26.3, 10.9.2, 11.1.2, and 12.0.4, there is a problem caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases. The resulting request was found to cause an uncaught exception that ends the nodejs process. The bug is fixed in octokit/webhooks.js 9.26.3, 10.9.2, 11.1.2, and 12.0.4, app.js 14.02, octokit.js 3.1.2, and Protobot 12.3.3.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| octokit | npm | 3.1.2 |
| @octokit/app | npm | 14.0.2 |
| probot | npm | 12.3.3 |
| @octokit/webhooks | npm | 12.0.3, 11.1.2, 10.9.2, 9.26.3 |
| octokit | octokit | 3.1.2 |
| webhooks | octokit | 12.0.4, 11.1.2, 10.9.2, 9.26.3 |
| probot | probot | 12.3.3 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| octokit | webhooks.js | >= 9.26.0, < 9.26.3, >= 10.9.0, < 10.9.2, >= 11.1.0, < 11.1.2 |
| octokit | app | 14.0.1 |
| npm | probot | 0 |
| octokit | webhooks | 11.0.0, 12.0.0, 0 |
| npm | octokit | 0 |
| octokit | webhooks.js | 9.26.0, 10.9.0, 11.1.0 |
Timeline
- Dec 15, 2023 CVE Published
- Dec 16, 2023 EPSS Score (30 in total, the first dated here)
- Jan 4, 2024 PoC Published (2 in total, the first dated here)
- Oct 5, 2024 Coalition ESS Score (4 in total, the first dated here)
- Nov 21, 2024 CVE Updated
- Jan 27, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-50728
vulnetix vdb fixes CVE-2023-50728Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-50728/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/octokit/webhooks.js/security/advisories/GHSA-pwfr-8pq7-x9qv x_refsource_CONFIRM
- https://github.com/octokit/app.js/releases/tag/v14.0.2 x_refsource_MISC
- https://github.com/octokit/octokit.js/releases/tag/v3.1.2 x_refsource_MISC
- https://github.com/octokit/webhooks.js/releases/tag/v10.9.2 x_refsource_MISC
- https://github.com/octokit/webhooks.js/releases/tag/v11.1.2 x_refsource_MISC
- https://github.com/octokit/webhooks.js/releases/tag/v12.0.4 x_refsource_MISC
- https://github.com/octokit/webhooks.js/releases/tag/v9.26.3 x_refsource_MISC
- https://github.com/probot/probot/releases/tag/v12.3.3 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2023-50728 advisory
- https://github.com/advisories/GHSA-pwfr-8pq7-x9qv advisory