Resource exhaustion in Yarnpkg Yarn
CVE-2025-9308
A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.002 (10.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Yarnpkg Yarn — versions 1.22.0, 1.22.1, 1.22.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required, VDB Entry)
- cna@vuldb.com (VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (issue-tracking, Exploit, Issue Tracking)
Frequently asked questions
- What is CVE-2025-9308?
- CVE-2025-9308 is a low-severity vulnerability in Yarnpkg Yarn, classified under Uncontrolled Resource Consumption. CVSS score: 3.3/10. Published 2025-08-21.
- How severe is CVE-2025-9308?
- Low severity. CVSS v3 base score is 3.3 out of 10.
- Is CVE-2025-9308 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.