Skip to content
Fencer Vulns
medium 5.4

CVE-2023-50728 json

Unauthenticated Denial of Service in the octokit/webhooks library

published 2023-12-15 2 y ago modified 2026-09-10 1 mo ago also GHSA-pwfr-8pq7-x9qv , EUVD-2023-3265

cvss
5.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

octokit/webhooks is a GitHub webhook events toolset for Node.js. Starting in 9.26.0 and prior to 9.26.3, 10.9.2, 11.1.2, and 12.0.4, there is a problem caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases. The resulting request was found to cause an uncaught exception that ends the nodejs process. The bug is fixed in octokit/webhooks.js 9.26.3, 10.9.2, 11.1.2, and 12.0.4, app.js 14.02, octokit.js 3.1.2, and Protobot 12.3.3.

Patch / fix

  • npm @octokit/webhooks 9.26.3, 10.9.2, 11.1.2, 12.0.3
  • npm @octokit/app 14.0.2
  • npm octokit 3.1.2
  • npm probot 12.3.3
  • octokit octokit 3.1.2
  • octokit webhooks 9.26.3, 10.9.2, 11.1.2, 12.0.4
  • probot probot 12.3.3

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-50728 updated cvss 7.5

octopost/webhooks: uncaught exception

  • Red Hat RHDH 1.1 for RHEL 9 rhdh/rhdh-hub-rhel9 1.1-97, rhdh/rhdh-rhel9-operator 1.1-85, rhdh/rhdh-operator-bundle 1.1-118
    fixed: vendor fix RHEA-2024:1366

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.90% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected packages

ecosystem package affected fixed in
npm @octokit/webhooks
<9.26.3
>=10.0.0, <10.9.2
>=11.0.0, <11.1.2
>=12.0.0, <12.0.3
9.26.3
10.9.2
11.1.2
12.0.3
npm @octokit/app
>=14.0.1, <14.0.2
14.0.2
npm octokit
<3.1.2
3.1.2
npm probot
<12.3.3
12.3.3

Affected products

  • octokit webhooks.js

Classification

Weakness
  • CWE-755 Improper Handling of Exceptional Conditions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.