CVE-2025-9308
Fixed in a distro release EPSS <1%CVSS 3.3
A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer.
Products: yarnpkg Yarn
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | yarn | no fix |
| Debian:12 | node-yarnpkg | no fix |
| Debian:13 | node-yarnpkg | 4.0.2+dfsg-2 |
| Debian:14 | node-yarnpkg | 4.0.2+dfsg-2 |
| Ubuntu:20.04:LTS | node-yarnpkg | no fix |
| Ubuntu:22.04:LTS | node-yarnpkg | no fix |
| Ubuntu:24.04:LTS | node-yarnpkg | no fix |
| Ubuntu:25.10 | node-yarnpkg | no fix |
| Ubuntu:26.04:LTS | node-yarnpkg | no fix |
| Ubuntu:26.10 | node-yarnpkg | no fix |
| Wolfi | yarn | no fix |