CVE-2025-8262 - yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos

Back Back to CVE browser

MEDIUM

yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos

Published Jul 28, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.74%

Description

A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076. It is recommended to apply a patch to fix this issue.

Affected products

Vendor Yarnpkg Product Yarn Default
n/a
- Version
  1.22.0
  Status
  affected
  Constraints
  -
- Version
  1.22.1
  Status
  affected
  Constraints
  -
- Version
  1.22.10
  Status
  affected
  Constraints
  -
- Version
  1.22.11
  Status
  affected
  Constraints
  -
- Version
  1.22.12
  Status
  affected
  Constraints
  -
- Version
  1.22.13
  Status
  affected
  Constraints
  -
- Version
  1.22.14
  Status
  affected
  Constraints
  -
- Version
  1.22.15
  Status
  affected
  Constraints
  -
- Version
  1.22.16
  Status
  affected
  Constraints
  -
- Version
  1.22.17
  Status
  affected
  Constraints
  -
- Version
  1.22.18
  Status
  affected
  Constraints
  -
- Version
  1.22.19
  Status
  affected
  Constraints
  -
- Version
  1.22.2
  Status
  affected
  Constraints
  -
- Version
  1.22.20
  Status
  affected
  Constraints
  -
- Version
  1.22.21
  Status
  affected
  Constraints
  -
- Version
  1.22.22
  Status
  affected
  Constraints
  -
- Version
  1.22.3
  Status
  affected
  Constraints
  -
- Version
  1.22.4
  Status
  affected
  Constraints
  -
- Version
  1.22.5
  Status
  affected
  Constraints
  -
- Version
  1.22.6
  Status
  affected
  Constraints
  -
- Version
  1.22.7
  Status
  affected
  Constraints
  -
- Version
  1.22.8
  Status
  affected
  Constraints
  -
- Version
  1.22.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Yarnpkg

Yarn

n/a

Version	Status	Constraints
1.22.0	affected	-
1.22.1	affected	-
1.22.10	affected	-
1.22.11	affected	-
1.22.12	affected	-
1.22.13	affected	-
1.22.14	affected	-
1.22.15	affected	-
1.22.16	affected	-
1.22.17	affected	-
1.22.18	affected	-
1.22.19	affected	-
1.22.2	affected	-
1.22.20	affected	-
1.22.21	affected	-
1.22.22	affected	-
1.22.3	affected	-
1.22.4	affected	-
1.22.5	affected	-
1.22.6	affected	-
1.22.7	affected	-
1.22.8	affected	-
1.22.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-1333

CWE-400

Uncontrolled Resource Consumption

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22855
Advisory
https://github.com/yarnpkg/yarn/pull/9199
issue-trackingExploit
https://github.com/yarnpkg/yarn/pull/9199/commits/97731871e674bf93bcbf29e9d3258da8685f3076
issue-trackingpatch
https://vuldb.com/?ctiid.317850
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.317850
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.617393
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-22855		Advisory
https://github.com/yarnpkg/yarn/pull/9199		issue-trackingExploit
https://github.com/yarnpkg/yarn/pull/9199/commits/97731871e674bf93bcbf29e9d3258da8685f3076		issue-trackingpatch
https://vuldb.com/?ctiid.317850		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.317850		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.617393		third-party-advisoryThird Party AdvisoryVDB Entry