CVE-2025-9308: yarnpkg Yarn request-manager.js setOptions redos

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-08-21 · updated 2026-06-17
Weakness: CWE-400

Description

A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer.

Affected products

yarn: through 1.22.22

References

https://github.com/yarnpkg/yarn/pull/9203
https://vuldb.com/?ctiid.320913
https://vuldb.com/?id.320913
https://vuldb.com/?submit.633486
https://github.com/yarnpkg/yarn/pull/9203

Get alerted when CVE-2025-9308 or the next vulnerability affects your stack