CVE-2025-9308

yarnpkg Yarn request-manager.js setOptions redos

State: Published
Severity: 4.8 Medium
Published: Aug 21, 2025
Updated: Aug 21, 2025
Reserved: Aug 21, 2025

Description

A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R	VulDB
3.0	3.3 Low	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R	VulDB
2.0	1.7 Low	AV:L/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:UR	VulDB

Weaknesses

CWE-1333 Inefficient Regular Expression Complexity
CWE-400 Resource Consumption

Affected Products

Product	Versions
Yarnyarnpkg	1.22.0Affected 1.22.1Affected 1.22.2Affected 1.22.3Affected 1.22.4Affected 1.22.5Affected 1.22.6Affected 1.22.7Affected 1.22.8Affected 1.22.9Affected 1.22.10Affected 1.22.11Affected 1.22.12Affected 1.22.13Affected 1.22.14Affected 1.22.15Affected 1.22.16Affected 1.22.17Affected 1.22.18Affected 1.22.19Affected 1.22.20Affected 1.22.21Affected 1.22.22Affected

References

VDB-320913 | yarnpkg Yarn request-manager.js setOptions redosvdb-entrytechnical-description
VDB-320913 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #633486 | yarn Yarn src/util/request-manager.js v1.22.22 Inefficient Regular Expression Complexitythird-party-advisory
https://github.com/yarnpkg/yarn/pull/9203issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.