yarnpkg Yarn request-manager.js setOptions redos_CVE-2025-9308

4.8 / 10

MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X

Description

A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer.

Basic Information

ID CVE-2025-9308

Source VulDB

Published Aug 21, 2025 at 16:02

Affected Product

Vendor yarnpkg

Product Yarn

Version 1.22.0

Affected Versions yarnpkg Yarn 1.22.0
yarnpkg Yarn 1.22.1
yarnpkg Yarn 1.22.2
yarnpkg Yarn 1.22.3
yarnpkg Yarn 1.22.4
yarnpkg Yarn 1.22.5
yarnpkg Yarn 1.22.6
yarnpkg Yarn 1.22.7
yarnpkg Yarn 1.22.8
yarnpkg Yarn 1.22.9
yarnpkg Yarn 1.22.10
yarnpkg Yarn 1.22.11
yarnpkg Yarn 1.22.12
yarnpkg Yarn 1.22.13
yarnpkg Yarn 1.22.14
yarnpkg Yarn 1.22.15
yarnpkg Yarn 1.22.16
yarnpkg Yarn 1.22.17
yarnpkg Yarn 1.22.18
yarnpkg Yarn 1.22.19
yarnpkg Yarn 1.22.20
yarnpkg Yarn 1.22.21
yarnpkg Yarn 1.22.22

CWE Classification

CWE-1333 CWE-400

References

{
    "lastseen": "",
    "description": "A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer.",
    "published": "2025-08-21T16:02:12.172Z",
    "modified": "2025-08-21T16:02:12.172Z",
    "type": "cve",
    "title": "yarnpkg Yarn request-manager.js setOptions redos",
    "source": "VulDB",
    "references": "https://vuldb.com/?id.320913\nhttps://vuldb.com/?ctiid.320913\nhttps://vuldb.com/?submit.633486\nhttps://github.com/yarnpkg/yarn/pull/9203",
    "id": "CVE-2025-9308",
    "bulletinFamily": "",
    "cwe": [
        "CWE-1333",
        "CWE-400"
    ],
    "cvelist": null,
    "sourceData": "yarnpkg Yarn 1.22.0\nyarnpkg Yarn 1.22.1\nyarnpkg Yarn 1.22.2\nyarnpkg Yarn 1.22.3\nyarnpkg Yarn 1.22.4\nyarnpkg Yarn 1.22.5\nyarnpkg Yarn 1.22.6\nyarnpkg Yarn 1.22.7\nyarnpkg Yarn 1.22.8\nyarnpkg Yarn 1.22.9\nyarnpkg Yarn 1.22.10\nyarnpkg Yarn 1.22.11\nyarnpkg Yarn 1.22.12\nyarnpkg Yarn 1.22.13\nyarnpkg Yarn 1.22.14\nyarnpkg Yarn 1.22.15\nyarnpkg Yarn 1.22.16\nyarnpkg Yarn 1.22.17\nyarnpkg Yarn 1.22.18\nyarnpkg Yarn 1.22.19\nyarnpkg Yarn 1.22.20\nyarnpkg Yarn 1.22.21\nyarnpkg Yarn 1.22.22",
    "sourceHref": "",
    "cvss": {
        "score": 4.8,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Yarn",
    "version": "1.22.0",
    "vendor": "yarnpkg",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}