CVE-2025-8262 yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos

What is CVE-2025-8262?

CVE-2025-8262 is a medium-severity denial of service vulnerability in yarnpkg Yarn, published on 28 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076. It is recommended to apply a patch to fix this issue.

Weakness: CWE-400, CWE-1333

Which versions are affected by CVE-2025-8262?

It affects 1 product.

Products include Yarnpkg Yarn.

How do I fix CVE-2025-8262?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-8262 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-8262 exists.

Other vulnerabilities in yarnpkg Yarn

• CVE-2019-5448 Missing Encryption of Sensitive Data in yarn High 8.1
• CVE-2019-10773 Yarn Improper link resolution before file access (Link Following) High 7.8
• CVE-2021-4435 Yarn: untrusted search path High 7.7
• CVE-2020-8131 Path Traversal in Yarn High 7.5
• CVE-2019-15608 TOCTOU Race Condition in Yarn Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2025-8262, DEBIAN-CVE-2025-8262, GHSA-9xhp-f235-5v37, MINI-r5rp-6854-5vpj, UBUNTU-CVE-2025-8262.