CVE-2025-8262
High · 7.5CVSS
7.5
EPSS
0.8%
Published
Jul 28, 2025
CISA due date
—
Cloudanix analysis
A bug in the Yarn package tool can let attackers slow down or stop software builds by feeding it specially crafted web addresses.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- Application
- Class
- Denial of service
- Remediation
- Patch
- Effort
- Low
- Patch risk
- Low
What it actually does
The flaw triggers catastrophic backtracking in a regular expression inside explodeHostedGitFragment, causing unbounded CPU consumption when processing a crafted hosted-git fragment.
Why it matters to the business
Package installation and resolution workflows can be stalled or aborted, delaying software builds, CI pipelines, and deployments across affected Linux environments.
How an attack unfolds
An attacker supplies a malicious git URL fragment to any Yarn operation that invokes the hosted-git resolver; the inefficient regex then performs excessive backtracking, consuming CPU until the process is terminated or the system becomes unresponsive.
How to fix it
Upgrade linux-lts (Alpaquita:stream) to 6.12.46-r0 or newer and linux-lts (Alpaquita:25) to 6.12.51-r0 or newer; apply the upstream patch 97731871e674bf93bcbf29e9d3258da8685f3076 where custom builds are required.
How to confirm the fix worked
Verify installed Yarn version is at or above the listed fixed releases; test resolution of known benign hosted-git fragments and confirm absence of excessive CPU or timeout behavior on crafted inputs.
Typical attack path
- Identify a target system or service that invokes Yarn with untrusted package metadata or URLs
- Craft a hosted-git fragment designed to trigger ReDoS in explodeHostedGitFragment
- Submit the fragment via package.json, lockfile, or direct resolver input
- Observe sustained high CPU usage or process termination on the target
How to detect it
Review Yarn process CPU usage and timeout logs during package resolution; inspect resolver input sources for unusually long or repetitive git URL fragments; correlate with process termination events in system logs.
What your security team should do
- Apply the listed fixed package versions immediately on all build and developer systems
- Scan dependency manifests for any direct or transitive use of vulnerable Yarn versions
- Add resource limits and timeouts around Yarn invocations in CI/CD to limit blast radius until patched
The record
A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076. It is recommended to apply a patch to fix this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | node-yarnpkg | 0 | No fix |
| Debian:12 | node-yarnpkg | 0 | No fix |
| Debian:13 | node-yarnpkg | 0 | No fix |
| Debian:14 | node-yarnpkg | 0 | No fix |