CVE-2025-8262: yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos
A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076. It is recommended to apply a patch to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
yarnpkgto a version that resolves this vulnerability.Fixed in 1.22.22 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 97731871e674bf93bcbf29e9d3258da8685f3076 - Configuration
Apply the patch 97731871e674bf93bcbf29e9d3258da8685f3076 to fix inefficient regular expression complexity in explodeHostedGitFragment (hosted-git-resolver.js) to remediate the remote ReDoS issue.
yarnpkg (src/resolvers/exotics/hosted-git-resolver.js) explodeHostedGitFragment inefficient regex complexity = patched
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8262?
CVE-2025-8262 has been classified as problematic due to its potential impacts on regular expression efficiency.
How do I fix CVE-2025-8262?
To fix CVE-2025-8262, upgrade Yarn to a version later than 1.22.22.
What versions of Yarn are affected by CVE-2025-8262?
CVE-2025-8262 affects Yarn versions up to and including 1.22.22.
What component of Yarn does CVE-2025-8262 impact?
CVE-2025-8262 impacts the explodeHostedGitFragment function in the hosted-git-resolver.js file.
What type of vulnerability is CVE-2025-8262?
CVE-2025-8262 is classified as a regular expression complexity vulnerability.