Log in Start free

Vulnerability · Published Aug 21, 2025 · Assigned by VulDB

CVE-2025-9308yarnpkg Yarn request-manager.js setOptions redos

Low 3.3

In plain English

A low-severity regular-expression denial of service in Yarn from yarnpkg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 88.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-yarnpkgno fix listedDEBIAN-CVE-2025-9308
Debian:13node-yarnpkg4.0.2+dfsg-2DEBIAN-CVE-2025-9308
Debian:14node-yarnpkg4.0.2+dfsg-2DEBIAN-CVE-2025-9308
Ubuntu:22.04:LTSnode-yarnpkgno fix listedUBUNTU-CVE-2025-9308
Ubuntu:24.04:LTSnode-yarnpkgno fix listedUBUNTU-CVE-2025-9308
Ubuntu:25.10node-yarnpkgno fix listedUBUNTU-CVE-2025-9308
Ubuntu:26.04:LTSnode-yarnpkgno fix listedUBUNTU-CVE-2025-9308
Ubuntu:26.10node-yarnpkgno fix listedUBUNTU-CVE-2025-9308

Affected products (as reported)

VendorProductVersions
yarnpkg Yarn 1.22.01.22.11.22.21.22.31.22.41.22.51.22.61.22.7

Weakness: CWE-1333, CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R

References