yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos

5.3 CVSS

Vulnerability Description

A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076. It is recommended to apply a patch to fix this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-8262

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

mmmsssttt (VulDB User)

References

More from yarnpkg

View All →

CVE-2025-9308

yarnpkg Yarn request-manager.js setOptions redos

Medium 4.8

CVE-2018-12556

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05...

Medium 5.9

Affected Vendor

yarnpkg

View all reports →

Affected Software

Yarn

Vulnerable Versions:

1.22.0, 1.22.1, 1.22.2, 1.22.3, 1.22.4, 1.22.5, 1.22.6, 1.22.7, 1.22.8, 1.22.9, 1.22.10, 1.22.11, 1.22.12, 1.22.13, 1.22.14, 1.22.15, 1.22.16, 1.22.17, 1.22.18, 1.22.19, 1.22.20, 1.22.21, 1.22.22