Critical Vulnerability in node-yarnpkg: Inefficient Regular Expression Complexity
Summary
DEBIAN-CVE-2025-8262: A vulnerability was found in yarnpkg Yarn up to 1.22.22. Affects node-yarnpkg versions 1.22.10+~cs22.25.14-3 – 4.1.0+dfsg-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-yarnpkg is a package manager for JavaScript, widely used for managing project dependencies. It simplifies the process of installing, updating, and configuring packages, making it an essential tool for developers. However, a recent vulnerability has been identified that affects its functionality and security, particularly in versions up to 1.22.22.
Vulnerability Detail
A vulnerability was discovered in the function explodeHostedGitFragment within the file src/resolvers/exotics/hosted-git-resolver.js of yarnpkg. This issue is classified as problematic due to its potential to lead to inefficient regular expression complexity, which can be exploited remotely. Attackers may leverage this vulnerability to degrade application performance or cause denial of service, impacting users and systems relying on the affected package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider limiting the use of the affected function or implementing input validation to minimize the risk of exploitation until the package can be updated.
Conclusion
In summary, the node-yarnpkg package has a critical vulnerability that can lead to inefficient regular expression complexity, potentially allowing remote exploitation. It is crucial to update to the patched version to mitigate risks and ensure the security and performance of your applications.
See every vulnerability recorded for node-yarnpkg →
FAQ
The vulnerability involves inefficient regular expression complexity in the yarnpkg package, which can be exploited remotely.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability may lead to performance degradation or denial of service, affecting users and systems relying on the package.
Yes, a patch has been identified, and it is recommended to update to the patched version of node-yarnpkg.
Update the node-yarnpkg package to the patched version and consider implementing input validation as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-yarnpkg.
