Critical Vulnerability in node-yarnpkg: Inefficient Regular Expression Complexity
Summary
DEBIAN-CVE-2025-9308: A vulnerability has been found in yarnpkg Yarn up to 1.22.22. Affects node-yarnpkg versions 1.22.10+~cs22.25.14-3 – 4.1.0+dfsg-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-yarnpkg is a package manager for JavaScript, designed to manage project dependencies efficiently. It provides features such as offline caching, deterministic installs, and a rich ecosystem of plugins. However, it has been identified that versions up to 1.22.22 are vulnerable to a specific issue that can lead to performance degradation due to inefficient regular expression handling.
Vulnerability Detail
A vulnerability has been discovered in yarnpkg Yarn up to version 1.22.22, specifically in the function setOptions located in src/util/request-manager.js. This vulnerability allows for manipulation that results in inefficient regular expression complexity, which can lead to performance issues. Local access is required to exploit this vulnerability, and it primarily affects products that are no longer supported by the maintainer.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the use of the affected function or avoid using features that rely on the vulnerable regular expression handling until a patch is applied.
Conclusion
The vulnerability in node-yarnpkg poses significant risks due to inefficient regular expression complexity. Users are advised to update their packages to the latest version to mitigate these risks. For those unable to update immediately, workarounds are available to minimize exposure.
See every vulnerability recorded for node-yarnpkg →
FAQ
The vulnerability involves inefficient regular expression complexity that can lead to performance issues.
Users of node-yarnpkg versions up to 1.22.22 are affected, particularly those using unsupported products.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Yes, updating to the latest version of node-yarnpkg will address this vulnerability.
Consider implementing workarounds such as limiting the use of the affected function until a patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-yarnpkg.
